https://main--justademo.netlify.app/tags/sandbox/ Recent content in Sandbox on Just A Demo Hugo en-us © Chad Metcalf Wed, 28 Oct 2026 09:00:00 -0700 https://main--justademo.netlify.app/posts/what-a-sandbox-owes-you/ Wed, 28 Oct 2026 09:00:00 -0700 https://main--justademo.netlify.app/posts/what-a-sandbox-owes-you/ <p>I wanted to learn more about nono, so I did what I usually do: I spun up a sandbox. A hosted VM around a coding agent, and <a href="https://nono.sh">nono</a> inside it, locking the agent to the project directory and a short list of hosts. Cover all the bases, right?</p> <p><code>nono</code> wouldn&rsquo;t start.</p> <div id="terminal-shortcode-1793514314891031832" class="terminal-window" role="group" aria-label="~/work/demo"> <div class="terminal-header"> <div class="terminal-title"> <span aria-hidden="true">$</span>~/work/demo </div> </div> <div class="terminal-content" > <pre class="terminal-pre" tabindex="0" role="region" aria-label="Terminal contents"><span class="terminal-prompt">$</span> <span class="terminal-cmd">nono run --allow-cwd -- cat ~/.aws/credentials</span> nono: Sandbox initialization failed: Landlock not available. Requires Linux kernel 5.13+ with Landlock enabled.</pre> </div> </div> <p>The kernel had been built without Landlock. No flag fixes that, and no package install. <code>nono</code> did the right thing. It refused to pretend. It would rather not run than run without enforcement.</p>