nsjail
A lightweight process isolation tool that utilizes Linux namespaces, cgroups, rlimits and seccomp-bpf syscall filters, leveraging the Kafel BPF language for enhanced security.
File Explorer
Download Latest Version (.zip)- dockerpush.yml
- apache.cfg
- bash-with-fake-geteuid.cfg
- bash-with-fake-geteuid.json
- chromium-with-net-wayland.cfg
- firefox-with-net-wayland.cfg
- firefox-with-net-X11.cfg
- hexchat-with-net.cfg
- home-documents-with-xorg-no-net.cfg
- imagemagick-convert.cfg
- static-busybox-with-execveat.cfg
- telegram.cfg
- tomcat8.cfg
- weechat-with-net.cfg
- xchat-with-net.cfg
- znc-with-net.cfg
- format
- changelog
- compat
- control
- copyright
- rules
- core.h
- encap.cc
- encap.h
- icmp.cc
- icmp.h
- iface.cc
- iface.h
- ip.cc
- ip.h
- net_defs.h
- nstun.cc
- nstun.h
- policy.cc
- policy.h
- tcp.cc
- tcp.h
- tun.cc
- tun.h
- udp.cc
- udp.h
- basic.cfg
- connect.cfg
- dns_http_host_to_guest.cfg
- nat-ip4-only.cfg
- nat-ip6-only.cfg
- nstun.cfg
- pasta-nat.cfg
- pasta-port-mappings.cfg
- redirect.cfg
- seccomp.cfg
- socks5.cfg
- traffic-drop-tcp4.cfg
- traffic-drop-udp6.cfg
- traffic-mixed.cfg
- traffic-rules.cfg
- record.h
- stats.cc
- stats.h
- syscall.cc
- syscall.h
- syscall_defs.h
- unotify.cc
- unotify.h
- unotify.proto
- .clang-format
- .clangd
- .gitignore
- .gitmodules
- caps.cc
- caps.h
- cgroup.cc
- cgroup.h
- cgroup2.cc
- cgroup2.h
- cmdline.cc
- cmdline.h
- config.cc
- config.h
- config.proto
- contain.cc
- contain.h
- CONTRIBUTING
- cpu.cc
- cpu.h
- Dockerfile
- kafel
- LICENSE
- logs.cc
- logs.h
- macros.h
- Makefile
- missing_defs.h
- mnt.cc
- mnt.h
- mnt_legacy.cc
- mnt_legacy.h
- mnt_newapi.cc
- mnt_newapi.h
- net.cc
- net.h
- nsjail.1
- nsjail.cc
- nsjail.h
- pid.cc
- pid.h
- README.md
- sandbox.cc
- sandbox.h
- subproc.cc
- subproc.h
- user.cc
- user.h
- util.cc
- util.h
- uts.cc
- uts.h
# Installation Guide
1. Get the code
git clone https://github.com/google/nsjail
Downloads the entire project code from GitHub to your computer.
cd nsjail
Moves into the project folder you just downloaded.
2. Official Install Script
Easy RecommendedPrerequisites
- APT (Debian/Ubuntu κ³μ΄) Built into Debian/Ubuntu-based Linux distributions.
sudo apt-get install autoconf bison flex gcc g++ git libprotobuf-dev libnl-route-3-dev libtool make pkg-config protobuf-compiler
Installs directly from the APT package repository (Debian/Ubuntu-based).
After installing, open a new terminal and run the program's version command (e.g. --version) to confirm it worked.
Pulled directly from this repo's README.
3. Docker
EasyPrerequisites
- Git Needed to download the project code from GitHub.
- Docker Desktop Needed to build and run containers. Install it and keep it running in the background.
docker build -t nsjail .
Builds a runnable image based on the Dockerfile.
docker run --privileged --rm -it nsjail nsjail --user 99999 --group 99999 --chroot / -- /bin/bash
Runs the built image as an actual container.
Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.
Pulled directly from this repo's README.
4. Make
MediumPrerequisites
- Git Needed to download the project code from GitHub.
- Make Usually pre-installed on Linux/macOS. On Windows, install separately (e.g. via MSYS2 or WSL).
make
Compiles the code based on the generated build configuration to produce an executable.
If it finishes without errors, it worked. Try running the generated executable directly.
Pulled directly from this repo's README.
// repository documentation
Was this content helpful?
(0 ratings)