Nono: Open-Source AI Agent Sandbox for Developers

Post Views: 4

Nono is an open-source runtime environment that restricts AI agents at the operating system kernel level, ensuring secure and controlled execution.

Introduction to Nono

An artificial intelligence coding agent initiates a terminal session, accesses a configuration file, and identifies an active cloud key stored in plaintext. It operates with the permissions of the user who initiated it. All files accessible to that user become available to the agent. All credentials within the environment are accessible to the agent. This level of access is where potential harm originates. A prompt injection, an incorrectly entered command, or an erroneous path can direct the agent toward an organization’s internal credentials and production systems.

Founders and Development

Luke Hinds, who developed Sigstore at Red Hat, a project focused on verifying software package origins, co-founded nolabs with Stephen Parkinson. The company introduced Nono, an open-source runtime environment that restricts AI agents at the operating system kernel level. Nono has garnered over 3,100 stars on GitHub, with contributions from more than 80 individuals. Its user base includes major enterprises and teams operating in regulated sectors.

Kernel-Level Enforcement

Nono evaluates every action taken by an agent against predefined policies written in code. When an agent requests to use a tool, access a file, or connect to a network endpoint, the kernel determines the outcome. Enforcement occurs at the operating system level, beneath the agent and any protective measures that might share its process. Nono utilizes Landlock on Linux and Seatbelt on macOS, kernel-level features that limit a process’s privileges and maintain those restrictions. Once the sandbox is applied, these constraints remain active for the duration of the process.

Cross-Platform Support

Support for Windows is currently provided through the Windows Subsystem for Linux (WSL2), which operates a genuine Linux kernel, allowing Nono’s Landlock enforcement to function identically to its native Linux implementation. Native Windows enforcement is under development, according to Hinds.

Agent Tool Sandboxing

Nono’s latest feature addresses broad, session-long permissions. Agent Tool Sandboxing assigns each tool call a specifically scoped authority. A tool receives a temporary credential acting as a substitute for a genuine secret. Its file access is limited to what the task requires. Its network connectivity is restricted to necessary endpoints. The authority expires once the call concludes. A tool utilizing a temporary substitute must still authenticate against an active service elsewhere.

Secure Credential Management

Hinds explained the process: Nono channels the request through a trusted proxy outside the sandbox, which retrieves the actual credential from secure storage such as the operating system’s keychain, 1Password, Bitwarden, or Kubernetes Secrets and injects it solely into the request sent to the approved external API.

Real-World Application

James Carnegie, a staff security engineer at Datadog, is among its users. Datadog engineers require their agents to operate efficiently while ensuring credentials and production systems remain secure. Nono is the sole sandbox offering both granular, command-specific policies and advanced credential management compatible with complex real-world toolchains.