nono README

The project's README from github.com/nolabs-ai/nono. As one markdown file: README.md.

nono logo

Built by the team that brought you Sigstore
The standard for secure software attestation, used by PyPI, npm, brew, and Maven Central

License CI Status OpenSSF Best Practices Documentation

Join Discord We're hiring agent-sign GitHub Action

[!NOTE] In the lead-up to a 1.0 release, APIs are stabilizing. API changes may still occur where necessary, but will be kept to a minimum.

[!IMPORTANT] Organization migration: The official nono registry namespace has moved from always-further to nolabs-ai. Update any references in your scripts, profiles, and CI. If you already have a pack installed under the old namespace, remove it first before pulling from the new one:

nono remove always-further/claude
nono pull nolabs-ai/claude

The old namespace will be retired — migrate now.

Run AI agents in a zero latency sandbox in seconds and with zero setup — Claude Code, Codex, Pi, CoPilot, Hermes, OpenCode, OpenClaw and more — nono gets you up and running within seconds, with no daemon, no container, no VM, and no disk space usage. Out of the box, nono enforces a least-privilege sandbox and supports macOS, Linux, and Windows (WSL2).

From here fork the config, tweak it, theme it, make it your own, and share it with your team or the community via the nono registry.

Want to operationalise and run at scale or within your team? Engineers at some of the largest tech companies in the world use nono as part of their workflows or to run AI agents in production.

“Datadog engineers want their agents to move fast, and we want our credentials and production systems kept safe while they do. nono is the only sandbox that gives us both fine-grained, per-command policies and sophisticated credential management that fits existing, complex real-world toolchains.” James Carnegie -- Staff Security Engineer, Datadog

"Security is embedded in everything we build at Okta. nono gives us the confidence to innovate with AI agents by isolating their execution in a highly secure, policy-controlled sandbox. It ensures our credentials remain locked down and protected, without sacrificing developer velocity" Leonardo Zanivan, Principal Engineer, Okta

Copied by many — nono pioneered the zero-latency, zero-setup agent sandbox, and continues to innovate and lead the way in agent sandboxing.

Quickstart

curl

curl -fsSL https://nono.sh/install.sh | sh

macOS / Linux (Homebrew)

brew install nono

Nix

The project provides a Nix flake that builds from source (first run compiles the crate and its dependencies):

# Run without installing
nix run github:nolabs-ai/nono

# Install into your profile
nix profile add github:nolabs-ai/nono

# Pin to the latest release
nix run "github:nolabs-ai/nono?ref=$(curl -fsSL https://api.github.com/repos/nolabs-ai/nono/releases/latest | jq -r .tag_name)"

Other platforms — Debian/Ubuntu, Fedora, Arch, RHEL, openSUSE, WSL2: see install instructions.

Run it!

Search for an agent in the registry, then run it:

$ nono search opencode
nolabs-ai/opencode	-	Official Opencode Plugin

$ nono run --profile nolabs-ai/opencode -- opencode

That's it. opencode now runs with read/write access to the current directory and nothing else — your SSH keys, your cloud credentials, the rest of your disk are invisible to it.

Profiles for all the popular agents live at registry.nono.sh, secured and ready to pull. Each one bundles the right filesystem scope, network allowlist, hooks, skills and more.

Make it your own!

Outgrow the defaults? Scaffold a profile and tweak it — same command you already know:

nono profile init opencode --extends nolabs-ai/opencode
nono run --profile opencode -- opencode

nono profile init exports an extended and editable profile file for your agent, that inherits from the specified base profile. That profile is composable JSON, so you can review the exact filesystem, network, credentials, and tool rules before sharing it with a team or publishing it for the community.

Are you an agent developer and want to publish your own agent package? We would love to have you and promote your work! See the docs.

Sandbox the tools agents call

nono does not stop at "put the agent in a sandbox". Agents delegate real work to tools: git, gh, curl, kubectl, package managers, build scripts, MCP clients / servers, and whatever else is on PATH. Those tools are often where secrets, network access, and side effects show up. Most sandboxes just give the agent a blanket policy where a secret is universally available to the entire agent and every tool, but nono is different:

nono can put delegated tools in their own isolated child sandboxes, outside the agent's control. The agent gets its session sandbox; when it calls a controlled tool, nono's broker launches that tool with a separate policy, separate filesystem grants, separate network rules, and separate credentials. The tool does not inherit the agent's broad --allow grants, CWD access, raw credential paths, or network access unless its own policy says so.

That means a profile can express rules like:

The policy lives in the profile, not in the prompt. The agent can ask for a tool, but it cannot widen that tool's sandbox, mint new keys, or bypass endpoint policy from inside the session.

{
  "command_policies": {
    "credentials": {
      "github-api": {
        "type": "proxy",
        "upstream": "https://api.github.com",
        "credential_key": "keyring://gh:github.com/example?decode=go-keyring",
        "env_var": "GH_TOKEN",
        "inject_header": "Authorization",
        "credential_format": "Bearer {}"
      }
    },
    "commands": {
      "gh": {
        "from": {
          "session": {
            "sandbox": {
              "fs_read": ["."],
              "credentials": [
                {
                  "name": "github-api",
                  "endpoint_policy": {
                    "default": "deny",
                    "allow": [
                      { "method": "GET", "path": "/repos/nolabs-ai/nono/issues/**" }
                    ]
                  }
                }
              ]
            },
            "invocation_policy": {
              "default": "deny",
              "allow": [
                { "argv": { "prefix": ["issue", "list"] } },
                { "argv": { "prefix": ["issue", "view"] } }
              ]
            }
          }
        }
      }
    }
  }
}

Read more in Sandboxed Tool Execution.

Ready to go deep?

Head over to the docs and discover nono's rich composable policy system, credentials injection, L7 filtering, supply chain security, rollback, multiplexing, audit and more.

Library support

nono provides FFI bindings for Rust, Python, TypeScript, and Go.

Also available as Python, TypeScript, and Go bindings.

Contributing

We encourage using AI tools to contribute. However, you must understand and carefully review any AI-generated code before submitting. Security is paramount. If you don't understand how a change works, ask in Discord first.

Security

If you discover a security vulnerability, please do not open a public issue. Follow the process in our Security Policy.

License

Apache-2.0

nono (nolabs-ai/nono)

Searching Database…

4.6K ·GitHub
Nono
Что это такое?nono — песочница без настройки и задержек, запускающая ИИ-агентов для кодинга (Claude Code, Codex, OpenCode и др.) с доступом по принципу наименьших привилегий: по умолчанию они не могут трогать ваши SSH-ключи, облачные креденшалы и весь остальной диск.
nono — это рантайм контейнеров вроде Docker или нечто более лёгкое?Это лёгкий CLI-рантайм песочниц, а не система контейнеров или виртуальных машин: ни демона, ни контейнера, ни ВМ, без накладных расходов на диск; написан на Rust.
Как установить его и запустить агента в песочнице?Установите через curl-скрипт или Homebrew на macOS/Linux (либо Nix flake), затем найдите в реестре и запустите агента, например opencode, — он получит доступ только на чтение/запись к текущему каталогу.
Каких агентов для кодинга nono поддерживает из коробки?Готовые профили есть для Claude Code, Codex, Pi, CoPilot, Hermes, OpenCode, OpenClaw и других — они подтягиваются из реестра nono.
Работает ли nono нативно на Windows?Из коробки он напрямую поддерживает macOS и Linux; поддержка Windows идёт через WSL2, а не через нативную песочницу Windows.
Как nono защищает мои креденшалы от инструментов, которые вызывает агент (git, gh, kubectl)?Инструменты, вызываемые агентом, работают в собственных изолированных дочерних песочницах с отдельными политиками файловой системы, сети и креденшалов, так что инструмент вроде gh получает токен только через credential-прокси nono, ограниченный конкретными методами API с помощью L7-фильтрации.
Можно ли настроить политику песочницы вместо профиля по умолчанию?Да, `nono profile init` создаёт редактируемый профиль, наследуемый от базового; он выражен компонуемым JSON с правилами для файловой системы, сети и креденшалов, который можно править и которым можно делиться.
Можно ли использовать nono как библиотеку в своём коде?Да, помимо CLI есть FFI-биндинги для Rust, Python, TypeScript и Go.
Почему бы просто не запускать агентов в контейнере Docker?Контейнеры и ВМ добавляют время настройки и расход диска; авторы nono сделали его ради песочниц без настройки и задержек, где не нужны демон, контейнер или ВМ.
nono изолирует только самого агента или ещё и вызываемые им инструменты?Он изолирует и делегированные инструменты: когда агент вызывает git или gh, брокер nono запускает этот инструмент с собственной отдельной политикой, правами файловой системы и креденшалами, вне контроля агента.
What are similar projects?awesome-agent-skills-security, defender, OpenAPPA, SkillSpector, VulnHunter, strix, trustmebro, geiger
Which topics is it in?mcp-security, ai-security-tool, zero-trust, agent-sandbox, agent-security, supply-chain-security, llm-security, ai-security, sandbox, cybersecurity, ai-agent, rust
Creator
nolabs-ai
Size
50.8 MB
Stars
4.6K
Updated
CommitOct 16Releasev0.80.0Oct 13
Age
8mo
Commits · 90 Days