Kernel Layer Primitives — Landlock LSM, seccomp-BPF Syscall Filtering, and Namespace Containment
Pure-Rust Linux container containment interfaces without C runtime or external daemon dependencies.
Dual-licensed underApache-2.0 OR MIT.
- Champion Inspiration: Bryan Cantrill (uncompromising systems observability, machine sympathy, and deterministic kernel boundaries).
- Substantive Systems Implementation: Fully functional Landlock LSM ruleset compilation, seccomp-BPF system call filtering, and Linux namespace isolation.
- Zero-I/O Domain Isolation:
kl-domaincontains zero system calls, zero filesystem interactions, and zero async runtimes. All ruleset representations, syscall policies, and invariant checks operate on pure memory structures.
| Crate | Responsibility |
|---|---|
crates/kl-domain |
Pure zero-I/O models: LandlockAbi, PathAccess, SeccompProfile, SyscallRule, and IsolationPlan. |
crates/kl |
Systems runtime and CLI (kl): Kernel ABI probing on isolated scratch threads, seccomp-BPF compilation, and namespace containment. |
# Probe Linux kernel Landlock ABI version and seccomp capabilities
kl probe# Validate internal consistency and invariants of an isolation plan
kl verify plan.jsonAll builds must specify -j 2 to prevent memory exhaustion on shared hosts:
cargo check -j 2
cargo test -j 2Dual-licensed under either of:
- Apache License, Version 2.0 (LICENSE-APACHE)
- MIT License (LICENSE-MIT)
See the unsigned-gg principles for the architectural doctrine and community standards.