01 / 10
Security
Open Source
Alpha
nono
AI Agent Security That Makes
the Dangerous Bits
Structurally Impossible
Kernel-enforced sandboxing for AI coding agents — credential protection, atomic rollback,
and immutable audit trails. From the creator of Sigstore.
02 / 10
The Problem
AI coding agents need powerful access to do useful work — but that same access is a massive security risk.
🔓
Full Filesystem Access
Agents read/write anywhere on the host — SSH keys, AWS credentials, Kubernetes configs, GPG secrets are all exposed.
💣
Destructive Commands
Nothing prevents rm -rf /, chmod 777, or sudo execution. One prompt injection away from catastrophe.
🎭
Prompt Injection
Guardrails and policies can be bypassed. Social engineering works on AI. Software-only restrictions are fundamentally breakable.
"Policies can be bypassed — and guardrails can be talked out of."
The core insight: any defense that runs in the same process as the agent can be defeated by the agent.
03 / 10
What is nono?
A kernel-enforced security sandbox for AI coding agents. It wraps any CLI agent in OS-level isolation
that cannot be bypassed — not by the agent, not by prompt injection, not even by nono itself.
Architecture: How nono wraps an AI agent
👤 Developer
→
nono sandbox
Kernel-enforced→
AI Agent
Amp / Claude / Codex→
📁 Filesystem
Restricted access
Once the sandbox is applied, restrictions are irreversible.
All child processes inherit the same restrictions.
macOS — Seatbelt
Uses Apple's built-in Seatbelt sandbox framework (macOS 10.5+). Kernel-level filesystem and process isolation.
Linux — Landlock LSM
Uses the Landlock Linux Security Module (kernel 5.13+). Filesystem access control enforced at the syscall level via restrict_self().
Created by Luke Hinds — the creator of Sigstore, the standard for secure software attestation
used by PyPI, npm, Homebrew, and Maven Central.
04 / 10
Key Features
Defense-in-depth: multiple layers of security that complement each other.
🔒
Kernel Sandbox
OS-level restrictions via Landlock/Seatbelt. Irreversible once applied. Cannot be bypassed by the agent process.
🔑
Credential Injection
Proxy mode: agent never sees API keys (even in memory). Env mode: loads from OS keystore or 1Password.
🌐
Network Filtering
Allowlist-based host filtering via local proxy. Cloud metadata endpoints hardcoded as denied. Block all or allow specific hosts.
🚫
Command Blocking
42 dangerous commands blocked: rm, dd, chmod, sudo, scp... Override per invocation or profile.
📸
Snapshot & Rollback
SHA-256 deduplicated, Merkle tree verified snapshots. Restore individual files or entire directories. Integrity verification built in.
📋
Audit Trail
Structured JSON logs of every command, timing, exit code, network event, and snapshot commitment. Immutable provenance chain.
✍️
Instruction Provenance
Cryptographically signs/verifies AGENTS.md and CLAUDE.md using Sigstore attestation (DSSE + in-toto/SLSA).
🎛️
Composable Policies
Named policy groups in JSON. Profiles reference groups by name. Fine-grained, reusable building blocks.
🔍
Supervisor Mode
Linux seccomp intercepts out-of-sandbox syscalls. Prompts user for approval. Sensitive paths are never-grantable.
05 / 10
+
Why nono Matters for Ampcode
Amp runs shell commands, reads/writes files, and executes code. nono makes this safe without limiting productivity.
🛡️
Sandboxed Execution
Wrap Amp in nono to restrict filesystem access to only the project directory. SSH keys, cloud credentials, and system configs are kernel-protected.
🔐
API Key Protection
nono's proxy mode keeps API keys entirely outside Amp's memory. The agent connects to localhost; the proxy injects real credentials upstream.
⏪
Atomic Rollback
If Amp makes unwanted changes, roll back to the exact pre-session state. Content-addressable, SHA-256 verified snapshots.
📜
AGENTS.md Provenance
nono cryptographically signs AGENTS.md — the instruction files Amp reads. Prevents supply chain attacks via tampered project instructions.
Ampcode + nono: Proposed usage
nono run --profile custom-amp --allow-cwd --rollback -- amp
nono run --proxy-credential anthropic --allow-cwd -- amp
nono run --allow-proxy api.anthropic.com --allow-proxy api.openai.com --allow-cwd -- amp
06 / 10
Real-World Usage
Insights from Shane Boulden's experience running Claude Code inside nono on Red Hat OpenShift.
🚧
Sandbox Blocked Unauthorized Access
When Claude tried to use a KUBECONFIG at an unauthorized path (/home/user/auth/kubeconfig), nono blocked it at the kernel level. Claude then found the correct, explicitly allowed path — exactly the intended behavior.
✅
Successful Deployment from Sandbox
Claude Code successfully built and deployed a container application on OpenShift — writing deployment templates, creating workloads, and verifying the endpoint — all from within the nono sandbox.
🔍
Audit & Rollback Verification
Session auditing captured exactly which files were created/modified. Merkle root verification passed on all 1,537 objects across 2 snapshots. Full rollback restored the working directory to pre-session state.
⚙️
Linux Troubleshooting Insights
Bun/JSC (Claude Code's runtime) needs /dev/urandom, /dev/null, and /dev/tty. Default policy didn't include these — requiring --allow-file flags. Real alpha-stage learning.
💡
Key takeaway: The agent adapted to the sandbox constraints organically. When a path was blocked,
the agent searched for the correct allowed path instead of failing. This is the "zero trust" model working as designed —
the kernel enforces policy, and the agent works within it.
07 / 10
Project Status
Where nono stands today — and what you need to know before using it.
⚠️
Early Alpha (v0.27.0) — This is an early alpha release that has not undergone comprehensive security audits.
While robust security measures are implemented, there may be undiscovered issues.
Not recommended for production until stable v1.0 release.
| Capability |
Status |
Platform |
| Kernel sandbox (Landlock) |
✔ Stable |
Linux (kernel 5.13+) |
| Kernel sandbox (Seatbelt) |
✔ Stable |
macOS 10.5+ |
| WSL2 support |
✔ Supported |
Windows via WSL2 |
| Native Windows |
✘ Coming Soon |
— |
| Credential proxy injection |
✔ Working |
All |
| Network filtering |
✔ Working |
All |
| Snapshot & rollback |
✔ Working |
All |
| Audit trail |
✔ Working |
All |
| Supervisor mode (seccomp) |
✔ Working |
Linux only |
| AGENTS.md provenance (Sigstore) |
✔ Working |
All |
| Built-in agent profiles |
✔ 5 profiles |
Claude Code, Codex, OpenCode, OpenClaw, Swival |
| Amp (Ampcode) built-in profile |
✘ Not yet |
Custom profile needed |
08 / 10
Using nono with Ampcode
Practical setup and configuration guide.
1. Install nono
brew install nono
nono setup
2. Basic Usage
nono run --allow-cwd --rollback -- amp
nono run --allow-cwd \
--allow-proxy api.anthropic.com \
--allow-proxy api.openai.com \
--rollback -- amp
3. Custom Amp Profile
{
"name": "amp",
"command": "amp",
"policy": {
"groups": ["deny_credentials",
"node_runtime"]
},
"network": { "outbound": "allowed" },
"allow": {
"read_write": ["$CWD",
"$HOME/.amp"]
}
}
4. After the Session
nono audit list
nono audit show <session-id> --json
nono rollback list
nono rollback restore <session-id>
09 / 10
Roadmap to the Future
What's coming for nono — and how it will benefit Ampcode users.
IN PROGRESS
Supervisor Lifecycle
Runtime lifecycle making supervisor the default execution mode. New commands:
ps, attach, detach, inspect, stop.
Enables managing multiple sandboxed agent sessions simultaneously.
IN PROGRESS
Packages & Skills System
Customized hooks, skills, and scripts for coding agents — with a community registry or any git repo as a source.
This could enable pre-built nono + Ampcode integration packages.
IN PROGRESS
Fully Composable Policy
Everything fully composable and group-based. Teams can share standardized security policies
across projects and agents — consistent security posture for Amp deployments.
PLANNED
Native Windows Support
Currently macOS + Linux + WSL2 only. Native Windows support will enable nono + Amp workflows
without requiring WSL2 — critical for Windows-first development environments.
FUTURE
Stable v1.0 + Security Audit
Comprehensive security audit and stable release. Production-ready for enterprise CI/CD pipelines
and team-wide agent deployment with auditable, kernel-enforced security.
10 / 10
Reference Links
Everything you need to get started and stay updated.
TL;DR: nono is the missing security layer for AI coding agents. It enforces restrictions at the kernel level —
making dangerous operations structurally impossible, not just discouraged. For Ampcode users, it means running Amp with
confidence: your credentials are protected, your filesystem is isolated, every action is audited, and everything is rollback-ready.
brew install nono
nono setup
nono run --allow-cwd --rollback -- amp