nono

nono puts AI coding agents like Claude Code and Codex in a locked room before they touch your machine. No container, no VM, no daemon: you grant the files, network hosts and credentials an agent gets, and the OS kernel enforces the rest. Apache 2.0 and free.

It runs on macOS (Seatbelt, the mechanism behind App Store sandboxing), Linux (Landlock, kernel 5.13+) and Windows via WSL2. Run brew install nono, pull your agent's profile from the nono registry, and go. The sharp part is per-tool policy: gh can get a GitHub token through a proxy, limited to the API paths you list, while the agent never sees it. Docker or E2B is the heavier route.

Solo, small teams, larger teams: all free today. nolabs, the Sigstore team behind it, is building a paid Enterprise layer (fleet-wide policy, audit trails, SSO, hosted agents) now in early access: GA in February 2027, no public price.

The catch: it's pre-1.0 and releases every week or two, so APIs still move. Per-port network filtering on Linux needs kernel 6.7+, WSL2 blocks the credential proxy by default, and native Windows is only a draft. A sandbox is only as tight as the profile you pull.