bubblewrap
Fence
https://github.com/Use-Tusk/fence
Lightweight, container-free sandbox for running commands with network and filesystem restrictions.
Fence wraps commands in a sandbox that blocks network access by default and restricts filesystem operations based on configurable rules. It's most useful for running semi-trusted code (package installs, build scripts, CI jobs, unfamiliar repos) with controlled side effects, and it can also complement AI coding agents as defense-in-depth.
Added 2 months ago