> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mirage.strukto.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandlock

> Run the host Python interpreter under Linux Landlock and seccomp confinement.

`sandlock` is the [`local`](/python/runtime/python#local) Python runtime with a
fence around it: the same host CPython, native wheels, and exact `sys.flags`,
but spawned through [Sandlock](https://github.com/multikernel/sandlock). A
Landlock ruleset and seccomp filter bound where its I/O can land.

<Note>
  **Sandlock is Python-only in Mirage today.** This is not a fundamental
  Sandlock restriction. The current adapter was implemented against Mirage's
  Python interpreter runtime; a TypeScript adapter around the same Sandlock CLI
  has not landed yet. Sandlock appears under **Sandbox** for discoverability,
  but it confines `python3` rather than capturing arbitrary command lines like
  Docker, smolvm, Daytona, and E2B.
</Note>

## Configure

Nothing is granted except the interpreter's own tree, the system paths CPython
needs to start, and the paths you list:

```yaml theme={null}
runtimes:
  - name: sandlock
    config:
      fs_readable: ["/opt/data"]
      fs_writable: ["/mnt/workspace"]
      max_memory: "512M"
  - vfs
```

It needs the `sandlock` CLI on `PATH`; there is no Mirage extra to install
because the CLI is the transport. Sandlock is **Linux only**, and its full
ruleset wants Landlock ABI v6 (Linux 6.12+). Sandlock's degrade options cover
older kernels with weaker protection.

The optional `home` config chooses a different Python interpreter. It accepts
an executable path or command name, then falls back to
`MIRAGE_SANDLOCK_HOME` and the interpreter running Mirage.

## Workspace access

Sandlock has `process` reach, the same as `local`. Confinement narrows which
host paths the code can touch, but the workspace gate never sees that I/O, so
mount modes, policy, and accounting do not apply to it.

Point `fs_writable` at a [FUSE-mounted](/python/setup/fuse) workspace path to
let confined code work on your mounts while reaching nothing else on the host.
Without FUSE, Sandlock code does not see Mirage's virtual workspace mounts.

## Environment

The runtime deliberately does not inherit the Mirage process environment.
Only the config `env` and the run's own environment are set, so confined code
is not handed the backend credentials Mirage is holding. Name every variable
the interpreter needs:

```yaml theme={null}
runtimes:
  - name: sandlock
    config:
      env:
        HOME: /tmp
        TZ: UTC
  - vfs
```