README

ai-jail

aijail.io

ai-jail runs AI coding agents in an OS sandbox: bubblewrap plus Landlock,
seccomp, and limits on Linux; sandbox-exec on macOS.

 What ai-jail is (and isn't)

ai-jail is not a lockdown or hard-security tool, and it is not a
boundary against malware or other hostile code — for that, use a disposable
VM. Its job is to be developer-friendly: it defends against a
trusted-but-fallible agent's mistakes, not against a motivated attacker
actively trying to escape.

Concretely, the first run for a known harness now reviews host access before
anything is saved. Dev tools, harness login state, and network access are
separate choices. A saved grant is convenient, but it is not a
lockdown-secure posture; anything inside the jail can use the granted resource.
The goal is to prevent _accidents_: an LLM running a mistyped command that
deletes unrelated important files outside the project, for example. With the
project directory as the blast radius, you can confidently turn on "YOLO
mode" (auto-accept, no confirmation prompts) in an AI harness with reasonable
confidence it won't damage anything outside the project scope.

It is a useful accident-prevention layer, not a replacement for a disposable
VM when running hostile code. See docs/SECURITY.md for
the full threat model.

 Install

bash
 Homebrew
brew tap akitaonrails/tap && brew install ai-jail

 Arch Linux
yay -S ai-jail-bin        prebuilt Linux x86_64 binary
yay -S ai-jail            build from source

 Debian / Ubuntu (prebuilt .deb; Debian 12+ / Ubuntu 22.04+)
 download ai-jail__amd64.deb from the GitHub release, then:
sudo apt install ./ai-jail__amd64.deb

 crates.io
cargo install --locked ai-jail

 Nix (flake) — sets BWRAP_BIN automatically
nix run github:akitaonrails/ai-jail -- claude
nix profile install github:akitaonrails/ai-jail

 GitHub Releases (signed archives, checksums alongside)
 ai-jail-linux-x86_64.tar.gz / ai-jail-macos-aarch64.tar.gz
 ai-jail__amd64.deb (Debian/Ubuntu)


Build from source with Rust 1.97.1:

bash
cargo build --release --locked
install -Dm755 target/release/ai-jail ~/.local/bin/ai-jail


Linux requires bwrap (bubblewrap): pacman -S bubblewrap,
apt install bubblewrap, or dnf install bubblewrap. BWRAP_BIN is accepted
only when it canonically resolves to a root-owned executable that is not
group- or world-writable, or to an executable with no write bits under a
/nix/store whose own owner is root (or an unmapped owner inside a user
namespace), is not world-writable, and carries the sticky bit if it is
group-writable — the standard multi-user store layout, mode 1775. A
group-writable store without the sticky bit is refused, because a group member
could then replace the binary. A single-user store owned by the invoking user
does not qualify either.
macOS uses Apple's deprecated /usr/bin/sandbox-exec interface. Windows is not
supported; use WSL2 and the Linux backend inside it.

 Quick start

bash
cd ~/Projects/my-app
ai-jail claude                    first run: