LANDRUN(1)

📦
version 0.1.17 · 3 versions
, in ubuntu stonking

💅 LANDRUN 💅

okay bestie, so landrun(1) is a section 1 user command and it's literally the moment — it runs your program inside a Landlock sandbox and I'm obsessed. Sit down, grab a strawberry drink 🍓, and let me tell you everything. no cap, every single flag, I promise.

✨ NAME ✨

landrun — run program in Landlock sandbox 🧚

that's it. that's the whole vibe. we put a little invisible fence around your process and let it live its life inside it. main character energy, but contained 💜

🦋 DESCRIPTION 🦋

🌸 NAME: 🌸

landrun — Run a command in a Landlock sandbox

🌈 USAGE: 🌈

landrun [global options]

so like, you call it, you hand it global options, and it does the sandbox thing. that's the shape of it, periodt.

⭐ VERSION: ⭐

0.1.17

✨ iconic number, no notes ✨

👑 GLOBAL OPTIONS: 👑

this is the good part. buckle up. --ro, --rw, --unix, --bind-tcp, --connect-tcp, --env — all of these can show up more than once, which is why they're written with the little [ ... ] repeat-y bit. slay.

  • --log-level string — set the logging level. your options are error, info, debug. default: "error". and yeah, it listens to the environment variable [$LANDRUN_LOG_LEVEL] too 🫶
  • --ro string [ --ro string ] — allow read-only access to this path 📖
  • --rox string [ --rox string ] — allow read-only access with execution to this path. reading AND running, she contains multitudes ✨
  • --rw string [ --rw string ] — allow read-write access to this path ✍️
  • --rwx string [ --rwx string ] — allow read-write access with execution to this path. the full package, truly 🔥
  • --unix string [ --unix string ] — allow connect(2)/sendmsg(2) on this pathname UNIX domain socket. heads up: this needs Landlock ABI v9+ 🧚
  • --bind-tcp int [ --bind-tcp int ] — allow binding to these TCP ports 🌐
  • --connect-tcp int [ --connect-tcp int ] — allow connecting to these TCP ports 🌐
  • --best-effort — use best effort mode, which means falling back to a less restrictive sandbox if necessary. default: false. lowkey a "we tried our best" situation, iykyk 😭
  • --env string [ --env string ] — environment variables to pass to the sandboxed command. give it KEY=VALUE, or just KEY to pass the current value 🎀
  • --unrestricted-filesystem — allow unrestricted filesystem access. default: false 👀
  • --unrestricted-network — allow unrestricted network access. default: false 👀
  • --unrestricted-scoped — allow unrestricted IPC scoping, meaning don't restrict abstract UNIX sockets and signals. needs Landlock ABI v6+. default: false
  • --ignore-missing — gracefully ignore paths that do not exist instead of failing. default: false. she's forgiving 💖
  • --log-disable-originating — disable audit logging of denials from the originating process. Landlock ABI v7+. default: false
  • --log-enable-subprocesses — enable audit logging of denials after execve(2) in subprocesses. Landlock ABI v7+. default: false
  • --log-disable-subdomains — disable audit logging of denials from nested Landlock domains. Landlock ABI v7+. default: false
  • --ldd — automatically detect and add library dependencies to --rox. default: false. lazy-girl automation and we love her for it 💅
  • --add-exec — automatically add the executable path to --rox. default: false ✨
  • --help, -h — show help 🙋
  • --version, -v — print the version 🏷️
heads up bestie — a bunch of these are gated on specific Landlock ABI versions (v6+, v7+, v9+). if your kernel isn't giving, you're not getting, so check before you assume, fr fr.

and that's the whole page, you ate it, mwah 💋

this was landrun 0.1.17-1, dated July 2026 🎀 go forth and sandbox responsibly, queen 👑

📦 where this page comes from