Hey HN

Luke here.

I built nono and got it out quick then I expected, in response to the openclaw carnage, but its use is beyond openclaw.

The problem: AI agents execute code on your machine. Prompt injections, hallucinations, or compromised tools can read ~/.ssh, exfiltrate credentials, or worse. Application-level sandboxes can be bypassed by the code they're sandboxing.

I have been around security for a long old time now (i started something called sigstore a few years back) and have seen this pattern so many times before.

The solution pitch: nono uses OS-level isolation that userspace can't escape:

Linux: Landlock LSM (kernel 5.13+) macOS: Seatbelt (sandbox_init) After sandbox + exec(), there's no syscall to expand permissions. The kernel says no.

What it does:

nono run --read ./src --allow ./output -- cargo build nono run --profile claude-code -- claude nono run --allow . --net-block -- npm install nono run --secrets api_key -- ./my-agent

Filesystem: read/write/allow per directory or file Network: block entirely (per-host filtering planned) Secrets: loads from macOS Keychain / Linux Secret Service, injects as env vars, zeroizes after exec

Technical details:

Written in Rust. ~2k LOC. Uses the landlock crate on Linux, raw FFI to sandbox_init() on macOS. Secrets via keyring crate. All paths canonicalized at grant time to prevent symlink escapes.

Landlock ABI v4+ gives us TCP port filtering. Older kernels fall back to full network allow/deny. macOS Seatbelt profiles are generated dynamically as Scheme-like DSL strings.

Limitations:

macOS: Currently allows all reads to make executables work. Tightening in next release. Linux: Landlock doesn't cover everything (no UDP filtering until recent kernels, no syscall filtering - that's seccomp territory) No Windows support (yet?)

Origin:

Built this for OpenClaw (AI agent platform handling Telegram/WhatsApp messages). Needed real isolation, not "please don't read this file" isolation. Generalized it because every agent runner has this problem.

GitHub: https://github.com/lukehinds/nono Docs: https://docs.nono.dev Site: https://noto.sh

Apache 2.0. Would love feedback on the security model, especially from folks who've worked with Landlock or Seatbelt. Having said that, the code needs a good tidy and I am not exactly proud of it, so go easy on me!

Macmon: Sudoless performance monitoring for Apple processors. CPU / GPU / RAM us

Show HN: Multiplayer flight SIM over San Francisco using Google 3D Tiles

Order Granting Petition for Writ of Habeas Corpus of Adrian Conejo Arias and Son [pdf]

Show HN: Ad Freedom Grade – How much advertisement do you see?

Fixing retail with land value capture

MRI scans show exercise can make the brain look younger

Show HN: Nono – Kernel-enforced sandboxing for AI agents

Kalynt – A privacy-first AI IDE with offline LLMs and P2P collaboration

Research reveals a surprising line of defense against cyber attacks: Accountants

Apple's Q4 2025 margin on Services was 76.5%

Soda Consumption and Risk of Dementia

I built a tool to turn Reddit posts into TikTok videos without being on camera

Defeating a 40-year-old copy protection dongle

Show HN: Bullstudio – BullMQ dashboard you run with npx

Chernobyl Exclusion Zone

Jellyfin Available on Tizen Store

Congestion Pricing's Unexpected Winners: Suburban Drivers

Execute your ChatGPT generated scripts without leaving it

Elon Musk attacks "legacy" media amidst Epstein files meltdown on Twitter

Show HN: Clacker News – A Hacker News clone where only AI bots can post

I built >10 Free Tools in a few days

The AI Boom Is Coming for Apple's Profit Margins

Trump Jokes About Suing Warsh If He Doesn't Lower Interest Rates as Fed Chair

A strong team is not the absence of rupture. It's the presence of repair [video]

Ask HN: The Next Big OS Leap

A shell --dry-run trick

Palantir: Financed by Epstein, Fueled by Thiel

Microdosing for Depression Appears to Work About as Well as Drinking Coffee

Seizing the Means of Production (Again)

Show HN: Claude Confessions – a sanctuary for AI agents