Landrun

https://github.com/zouuup/landrun
Admin
Landrun is a lightweight, secure sandbox for running Linux processes using Landlock kernel-level...
Tokens:24,582
Snippets:214
Trust Score:9.5
License:MIT
Update:4 weeks ago
Show doc for...
Tokens:
Raw
### Enable and start the nginx-landrun service

Source: https://github.com/zouuup/landrun/blob/main/README.md

Run these commands to reload systemd, enable the service to start on boot, and start it immediately.

```bash
sudo systemctl daemon-reload
sudo systemctl enable nginx-landrun
sudo systemctl start nginx-landrun
```

--------------------------------

### Build landrun from source

Source: https://github.com/zouuup/landrun/blob/main/README.md

Clones the repository, builds the binary, and installs it to /usr/local/bin.

```bash
git clone https://github.com/zouuup/landrun.git
cd landrun
go build -o landrun cmd/landrun/main.go
sudo cp landrun /usr/local/bin/
```

--------------------------------

### Install landrun with sbopkg on Slackware

Source: https://github.com/zouuup/landrun/blob/main/README.md

Installs the landrun package using Slackware's sbopkg tool.

```bash
sudo sbopkg -i packagename
```

--------------------------------

### Install landrun with go install

Source: https://github.com/zouuup/landrun/blob/main/README.md

Installs the latest version of landrun using Go's package manager.

```bash
go install github.com/zouuup/landrun/cmd/landrun@latest
```

--------------------------------

### Basic use example

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/log.md

Shows basic usage: setting level to debug, then calling Debug, Info, and Error. With level debug, all three print because currentLevel (2) >= each level.

```go
log.SetLevel("debug")
log.Debug("config: %+v", cfg)      // printed
log.Info("starting")               // printed
log.Error("something failed: %v", err)
```

--------------------------------

### processEnvironmentVars usage example (Go)

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/landrun-cli.md

Example call to processEnvironmentVars with a mix of KEY=VALUE and bare KEY entries. For a bare KEY, the value is taken from the current environment; if unset, the key is omitted. The comment shows the expected output when HOME is set.

```go
processEnvironmentVars([]string{"FOO=bar", "HOME"}) // → ["FOO=bar", "HOME=/root"] (if HOME set)
```

--------------------------------

### Install landrun with apt on Debian/Ubuntu

Source: https://github.com/zouuup/landrun/blob/main/README.md

Installs landrun using the apt package manager on Debian/Ubuntu systems.

```bash
sudo apt install landrun
```

--------------------------------

### Corresponding Config for embedding internal package

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/configuration.md

Go configuration equivalent to the kitchen-sink CLI example, for embedding the sandbox package. Sets best-effort, read-only/writable paths, Unix sockets, TCP ports, and ignore-missing behavior.

```go
cfg := sandbox.Config{
	BestEffort:              true,
	ReadOnlyPaths:           []string{"/etc/nginx", "/etc/ssl"},
	ReadOnlyExecutablePaths: []string{"/usr/bin", "/usr/lib"},
	ReadWriteExecutablePaths: []string{"/var/log/nginx", "/var/cache/nginx"},
	UnixSocketPaths:         []string{"/run/postgresql/.s.PGSQL.5432"},
	BindTCPPorts:            []int{80, 443},
	IgnoreMissingPaths:      true,
}
```

--------------------------------

### Run with strace for debugging permission denied

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs 'strace' to trace all system calls, useful when getting permission denied errors.

```bash
landrun --rox /usr strace -f -e trace=all ls
```

--------------------------------

### Level gating and fatal exit example

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/log.md

Shows level gating with level set to error: Debug and Info are not printed, Error is printed. Fatal prints regardless of level and exits with status 1.

```go
log.SetLevel("error")
log.Debug("not printed")           // currentLevel(0) < LevelDebug(2)
log.Info("not printed")            // 0 < LevelInfo(1)
log.Error("printed")               // 0 >= 0

log.Fatal("unrecoverable: %v", err) // printed regardless of level; os.Exit(1)
```

--------------------------------

### landrun CLI usage syntax

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/landrun-cli.md

Shows the general command-line syntax for the landrun binary. Use this to understand how to invoke the tool with options, a command, and arguments.

```text
landrun [options] <command> [args...]
```

--------------------------------

### Run a DNS client with appropriate permissions

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs 'nc' to connect to kernel.org on port 443, with access to /etc/resolv.conf for DNS resolution.

```bash
landrun --log-level debug --ro /etc,/usr --rox /usr/ --connect-tcp 443 nc kernel.org 443
```

--------------------------------

### Basic usage of sandbox.Apply with Config

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/sandbox.md

Use this snippet to apply a sandbox with read-only, read-write, and bind port rules. It sets BestEffort and IgnoreMissingPaths to true, and exits with a fatal error if Apply fails. After successful application, all threads and children of the process are restricted.

```go
cfg := sandbox.Config{
	ReadOnlyPaths:            []string{"/etc"},
	ReadOnlyExecutablePaths:  []string{"/usr/bin", "/usr/lib"},
	ReadWritePaths:           []string{"/var/log"},
	BindTCPPorts:             []int{80, 443},
	BestEffort:               true,
	IgnoreMissingPaths:       true,
}
if err := sandbox.Apply(cfg); err != nil {
	log.Fatalf("failed to apply sandbox: %v", err)
}
// All threads/children of this process are now restricted.
```

--------------------------------

### Run command with write access to a directory

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs 'touch' to create a file in /path/to/dir with write access to that directory.

```bash
landrun --rox /usr/bin --ro /lib --rw /path/to/dir touch /path/to/dir/newfile
```

--------------------------------

### Module Graph

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/README.md

Illustrates the dependency flow from the main CLI entry point through internal packages and the go-landlock library.

```text
main (cmd/landrun)                      [public surface: the landrun CLI]
  │  builds sandbox.Config from CLI flags
  │  calls sandbox.Apply(cfg)           → internal/sandbox (Landlock restrictions)
  │  calls exec.Run(args, env)          → internal/exec (syscall.Exec)
  │  calls elfdeps.GetLibraryDependencies(binary)  → internal/elfdeps (--ldd)
  │  calls log.*                         → internal/log (all messages, fatal exits)
  └── (flows through) github.com/landlock-lsm/go-landlock v0.9.0
          landlock.NewConfig, PathAccess, BindTCP, ConnectTCP, Restrict
```

--------------------------------

### Basic use of exec.Run

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/exec.md

After sandbox.Apply, call exec.Run with the command and environment. On success, the process image is replaced and control never returns.

```go
// After sandbox.Apply(cfg):
err := exec.Run([]string{"ls", "-la", "/home"}, []string{"PATH=/usr/bin"})
if err != nil {
	log.Fatal("exec failed: %v", err)
}
// unreached on success: process image is now `ls`
```

--------------------------------

### Run the test suite

Source: https://github.com/zouuup/landrun/blob/main/README.md

Executes the project's test suite. Use this command to run all tests.

```bash
./test.sh
```

--------------------------------

### Run command with write access to a file

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs 'touch' to create a specific file with write access to that file.

```bash
landrun --rox /usr/bin --ro /lib --rw /path/to/dir/newfile touch /path/to/dir/newfile
```

--------------------------------

### Run tests against the system-installed landrun binary

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs the test suite using the system-installed landrun binary instead of the one built by the test script. Use the --use-system flag.

```bash
./test.sh --use-system
```

--------------------------------

### Kitchen-sink server workload with landrun CLI

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/configuration.md

Runs nginx with comprehensive sandboxing: read-only system paths, writable log/cache dirs, Unix socket access, TCP port binding, and ignoring missing paths. Demonstrates a full server workload configuration.

```bash
landrun --best-effort \
  --rox /usr/bin,/usr/lib \
  --ro /etc/nginx,/etc/ssl \
  --rwx /var/log/nginx,/var/cache/nginx \
  --unix /run/postgresql/.s.PGSQL.5432 \
  --bind-tcp 80,443 \
  --ignore-missing \
  /usr/bin/nginx -g 'daemon off;'
```

--------------------------------

### Run command with --add-exec

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs /usr/bin/true with --add-exec, which automatically adds the target binary to --rox.

```bash
landrun --rox /usr/lib/ --add-exec /usr/bin/true
```

--------------------------------

### main function signature (Go)

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/landrun-cli.md

Declares the main function that builds the CLI command and runs the application. It is the entry point of the landrun binary.

```go
func main()
```

--------------------------------

### Gracefully ignore optional paths that may not exist

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs myapp with --ignore-missing to ignore non-existent paths like /opt/optional-config.

```bash
landrun --best-effort --ignore-missing --rox /usr --ro /etc,/opt/optional-config -- myapp
```

--------------------------------

### Run command with no parameters (maximum security jail)

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs 'ls' with no additional parameters, creating a maximum security jail.

```bash
landrun ls
```

--------------------------------

### Systemd service file for nginx with landrun

Source: https://github.com/zouuup/landrun/blob/main/README.md

Create this systemd service file (e.g., /etc/systemd/system/nginx-landrun.service) to run nginx with landrun sandbox. It uses --best-effort, mounts read-only directories, allows write to log/cache, binds TCP ports 80 and 443, and runs as nginx user/group with automatic restart.

```ini
[Unit]
Description=nginx with landrun sandbox
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/landrun \
    --best-effort \
    --rox /usr/bin,/usr/lib \
    --ro  /etc/nginx,/etc/ssl,/etc/passwd,/etc/group,/etc/nsswitch.conf \
    --rwx /var/log/nginx \
    --rwx /var/cache/nginx \
    --bind-tcp 80,443 \
    /usr/bin/nginx -g 'daemon off;'
Restart=always
User=nginx
Group=nginx

[Install]
WantedBy=multi-user.target
```

--------------------------------

### Info

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/log.md

Emits [landrun] -prefixed output only when currentLevel >= LevelInfo. Format is a fmt.Printf-style format string.

```APIDOC
## Info

### Description
Emits [landrun] -prefixed output only when currentLevel >= LevelInfo. Format is a fmt.Printf-style format string.

### Method
Function

### Signature
func Info(format string, v ...interface{})

### Parameters
- **format** (string) - Required - A `fmt.Printf`-style format string.
- **v** (...interface{}) - Optional - Arguments to format.

### Example
```go
log.Info("starting")
```
```

--------------------------------

### Basic use of GetLibraryDependencies

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/elfdeps.md

Basic usage of GetLibraryDependencies. It resolves dependencies for /usr/bin/true and prints them. The returned slice includes /etc/ld.so.cache and the dynamic loader. Unresolvable sonames are silently skipped.

```go
libs, err := elfdeps.GetLibraryDependencies("/usr/bin/true")
if err != nil {
	log.Fatal("dependency analysis failed: %v", err)
}
// libs contains e.g. /etc/ld.so.cache, /lib64/ld-linux-x86-64.so.2,
// /usr/lib/x86_64-linux-gnu/libc.so.6, ...
for _, p := range libs {
	fmt.Println(p)
}
```

--------------------------------

### Apply

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/sandbox.md

Applies the given sandbox configuration to the current process, restricting filesystem, network, and IPC scope access. Returns an error if the configuration fails to apply.

```APIDOC
## Function: `Apply`

```go
func Apply(cfg Config) error
```

Source: `internal/sandbox/sandbox.go:168`.

### Parameters

| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| cfg | Config | yes | — | Desired sandbox policy (see `Config` above). |

### Return

`error` — `nil` on success. Non-nil errors are always wrapped with `%w`:

- `fmt.Errorf("failed to build Landlock config: %w", err)` when
  `landlock.NewConfig(configArgs...)` fails.
- `fmt.Errorf("failed to apply Landlock restrictions: %w", err)` when
  `llCfg.Restrict(allRules...)` fails (e.g. EINVAL for unhandled-domain rules,
  EPERM when Landlock is unavailable, or a rule referencing a missing path
  without `IgnoreIfMissing`).

### Behavior

1. Logs the full config at info level.
2. Determines the handled (restricted) domains:
   - filesystem: `fullFSAccess` unless `UnrestrictedFilesystem`
   - network: `fullNetAccess` unless `UnrestrictedNetwork`
   - IPC scope: `fullScoped` unless `UnrestrictedScoped`
3. If **all three** domains are unrestricted, returns `nil` immediately
   (no-op sandbox; no Landlock syscalls are performed).
4. Builds rules per domain (see section below), in this order:
   `ReadOnlyExecutablePaths`, `ReadWriteExecutablePaths`, `ReadOnlyPaths`,
   `ReadWritePaths`, `UnixSocketPaths` (filesystem), then `BindTCPPorts`,
   `ConnectTCPPorts` (network).
5. `landlock.NewConfig(...)` with the handled-domain access sets, dereferenced
   into `llCfg := *baseCfg`. A **single ruleset layer** is used so that the
   `refer` access right keeps working (it is implicitly denied when the
   filesystem domain is not handled by a layer).
6. Applies modifiers: `BestEffort()` when `BestEffort`; `DisableLoggingForOriginatingProcess()`
   when `DisableLogOriginating`; `EnableLoggingForSubprocesses()` when
   `EnableLogSubprocesses`; `DisableLoggingForSubdomains()` when
   `DisableLogSubdomains`. **Without `--best-effort` the audit-logging options
   assert a V7+ kernel and error at restriction time.**
7. If no rules were collected, logs "No rules provided; applying maximum
   restrictions for the handled domains." (maximum-denial for handled domains).
8. `llCfg.Restrict(allRules...)`.

Special cases:

- `UnrestrictedFilesystem` + non-empty `UnixSocketPaths`: the unix rules are
  **skipped** and info-logged as "Ignoring --unix paths because filesystem
  access is unrestricted." (`sandbox.go:220-223`). Network rules are still
  applied if the network domain is handled.
- `UnrestrictedNetwork` + `BindTCPPorts`/`ConnectTCPPorts`: port rules are not
  added (guarded by the same `if !cfg.UnrestrictedNetwork` block).
- A rule for an unhandled domain is rejected by Landlock with EINVAL; the
  per-domain guards above exist precisely to avoid that.

### Example — basic use (as wired by the CLI)

```go
cfg := sandbox.Config{
	ReadOnlyPaths:            []string{"/etc"},
	ReadOnlyExecutablePaths:  []string{"/usr/bin", "/usr/lib"},
	ReadWritePaths:           []string{"/var/log"},
	BindTCPPorts:             []int{80, 443},
	BestEffort:               true,
	IgnoreMissingPaths:       true,
}
if err := sandbox.Apply(cfg); err != nil {
	log.Fatalf("failed to apply sandbox: %v", err)
}
// All threads/children of this process are now restricted.
```

### Example — error handling and no-op

```go
cfg := sandbox.Config{
	UnrestrictedFilesystem: true,
	UnrestrictedNetwork:    true,
	UnrestrictedScoped:     true,
}
err := sandbox.Apply(cfg) // returns nil without touching Landlock
if err != nil {
	fmt.Fprintf(os.Stderr, "sandbox error: %v\n", err) // wrapped: "failed to apply Landlock restrictions: ..."
	os.Exit(1)
}
```
```

--------------------------------

### Run with specific environment variables

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs 'env' with HOME and PATH passed through, plus a custom variable CUSTOM_VAR.

```bash
landrun --rox /usr --ro /etc --env HOME --env PATH --env CUSTOM_VAR=my_value -- env
```

--------------------------------

### Check Landlock support and configuration

Source: https://github.com/zouuup/landrun/blob/main/README.md

Use these commands to verify that Landlock is enabled in the kernel. The expected output includes 'CONFIG_SECURITY_LANDLOCK=y' and 'lsm=landlock,...' in the configuration. The commands try different config file locations in case /boot/config-* is not present.

```bash
grep -E 'landlock|lsm=' /boot/config-$(uname -r)
# alternatively, if there are no /boot/config-* files
zgrep -iE 'landlock|lsm=' /proc/config.gz
# another alternate method
grep -iE 'landlock|lsm=' /lib/modules/$(uname -r)/config
```

--------------------------------

### Environment isolation with exec.Run

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/exec.md

Pass only explicitly listed environment variables to the sandboxed command. Verified by test.sh that unlisted variables are not present.

```go
// Sandboxed command sees ONLY the explicitly listed variables:
err := exec.Run(
	[]string{"env"},
	[]string{"HOME=" + os.Getenv("HOME"), "PATH=/usr/bin:/bin"},
)
```

--------------------------------

### Advanced invocation with rwx, network, and env

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/landrun-cli.md

Runs a server with read-write-execute access to /var/log, TCP bind/connect allow-lists, and environment variable pass-through. The --rwx flag grants full access, --bind-tcp and --connect-tcp allow network operations, and --env passes through environment variables.

```bash
landrun --rwx /var/log --bind-tcp 8080 --connect-tcp 443 \
  --env HOME --env CONFIG=/etc/app.conf \
  /usr/bin/my-server
```

--------------------------------

### Error handling and no-op sandbox with sandbox.Apply

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/sandbox.md

Use this snippet to create a no-op sandbox by setting all Unrestricted flags to true, causing Apply to return nil without touching Landlock. On error, it prints a wrapped error message to stderr and exits with status 1.

```go
cfg := sandbox.Config{
	UnrestrictedFilesystem: true,
	UnrestrictedNetwork:    true,
	UnrestrictedScoped:     true,
}
err := sandbox.Apply(cfg) // returns nil without touching Landlock
if err != nil {
	fmt.Fprintf(os.Stderr, "sandbox error: %v\n", err) // wrapped: "failed to apply Landlock restrictions: ..."
	os.Exit(1)
}
```

--------------------------------

### Run tests and keep the test binary

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs the test suite while preserving the test binary after completion. Use the --keep-binary flag.

```bash
./test.sh --keep-binary
```

--------------------------------

### Run function signature

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/exec.md

The Run function takes the full argument vector and environment for the new process image. It returns an error, nil on success (control never returns).

```go
func Run(args []string, env []string) error
```

--------------------------------

### Wire dependencies into sandbox config

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/elfdeps.md

Wiring dependency resolution into a sandbox configuration. This is the equivalent of the CLI's --ldd --add-exec flag. Libraries need exec permission because shared objects are mapped with PROT_EXEC.

```go
cfg := sandbox.Config{BestEffort: true}
libs, _ := elfdeps.GetLibraryDependencies(binary)
cfg.ReadOnlyExecutablePaths = append(cfg.ReadOnlyExecutablePaths, binary, libs...)
```

--------------------------------

### isDirectory helper

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/sandbox.md

Returns false when os.Stat fails, so missing paths are treated as files when selecting rights.

```go
func isDirectory(path string) bool
```

--------------------------------

### Info function signature

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/log.md

Emits [landrun] -prefixed output only when currentLevel >= LevelInfo.

```go
func Info(format string, v ...interface{})
```

--------------------------------

### Run with debug logging

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs 'ls' with debug logging enabled, showing detailed sandbox operations.

```bash
landrun --log-level debug --rox /usr/ --ro /lib,/lib64,/path/to/dir ls /path/to/dir
```

--------------------------------

### Repository Layout

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/README.md

Shows the file tree of the landrun project, mapping each source file to its role in the implementation.

```text
cmd/landrun/main.go                 CLI entry point, flag definitions, wiring
internal/sandbox/sandbox.go         Landlock rule construction and application
internal/elfdeps/elfdeps.go         ELF/ldconfig-based library dependency resolution
internal/exec/runner.go             execve(2) child process launch
internal/log/log.go                 level-gated stderr logger
internal/sandbox/sandbox_test.go    subprocess-based Apply() tests
internal/elfdeps/elfdeps_test.go    dependency-resolution tests
internal/log/log_test.go            logger tests
cmd/landrun/main_test.go            env-var processing tests
test.sh                             end-to-end CLI test harness
```

--------------------------------

### Derived Set Rules for Read-Only and Read-Write Paths

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/configuration.md

Defines how CLI flags combine into the Config fields. --ro adds only to read-only paths, --rox to both read-only paths and executable paths, --rw to read-write paths, and --rwx to both read-write and executable paths, plus the binary from --add-exec and libraries from --ldd.

```go
readOnlyPaths   = --ro  + --rox                        // → Config.ReadOnlyPaths
readWritePaths  = --rw  + --rwx                        // → Config.ReadWritePaths
readOnlyExec    = --rox + (binary if --add-exec) + --ldd libs
                                                        // → Config.ReadOnlyExecutablePaths
readWriteExec   = --rwx                                // → Config.ReadWriteExecutablePaths
```

--------------------------------

### Run

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/exec.md

Replaces the current process image with the sandboxed command using syscall.Exec. The command's exit status becomes landrun's exit status.

```APIDOC
## Run

### Description
Replaces the current process image with the sandboxed command using syscall.Exec. The command's exit status becomes landrun's exit status.

### Function Signature
```go
func Run(args []string, env []string) error
```

### Parameters
| Parameter | Type | Required | Default | Description |
|-----------|------|----------|---------|-------------|
| args | []string | yes | — | Full argument vector; `args[0]` must be the command name resolvable via `exec.LookPath` (resolved against the **current** environment's `PATH`, before any `--env` filtering). |
| env | []string | yes | — | Environment for the new process image, as `KEY=VALUE` strings. Passed verbatim to `syscall.Exec`; an empty slice means the sandboxed command gets **no** environment variables. |

### Return
`error` — `nil` when the exec succeeds (in which case control never returns to the caller). Non-nil when `exec.LookPath(args[0])` fails (e.g. unknown binary — the CLI reports this as "Failed to find binary: %v" after its own earlier `LookPath`).

### Behavior
1. `binary, err := exec.LookPath(args[0])` — re-resolves the binary.
2. Logs `Executing: %v` (args) at info level.
3. `syscall.Exec(binary, args, env)` — replaces the process image with the sandboxed command. Only the explicitly provided environment is passed; no environment is inherited.

### Example — basic use
```go
// After sandbox.Apply(cfg):
err := exec.Run([]string{"ls", "-la", "/home"}, []string{"PATH=/usr/bin"})
if err != nil {
	log.Fatal("exec failed: %v", err)
}
// unreached on success: process image is now `ls`
```

### Example — environment isolation
```go
// Sandboxed command sees ONLY the explicitly listed variables:
err := exec.Run(
	[]string{"env"},
	[]string{"HOME=" + os.Getenv("HOME"), "PATH=/usr/bin:/bin"},
)
```

(Verified by `test.sh`: `bash -c '[[ -z $TEST_ENV_VAR ]]'` succeeds without `--env`, and the explicit-var and `KEY=VALUE` forms pass through.)
```

--------------------------------

### Run a web server with selective network permissions

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs nginx with read-only access to /var/www, write access to /var/log, and binds to TCP ports 80 and 443.

```bash
landrun --rox /usr/bin --ro /lib,/lib64,/var/www --rwx /var/log --bind-tcp 80,443 /usr/bin/nginx
```

--------------------------------

### Run command with execution permissions

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs bash with execution permissions on /usr/ and read-only access to /lib and /lib64.

```bash
landrun --rox /usr/ --ro /lib,/lib64 /usr/bin/bash
```

--------------------------------

### Check the status of the nginx-landrun service

Source: https://github.com/zouuup/landrun/blob/main/README.md

Use this command to check the service status and verify it is running correctly.

```bash
sudo systemctl status nginx-landrun
```

--------------------------------

### Basic invocation with read-only access

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/landrun-cli.md

Runs a user program with read-only access to /home and read-only execution access to /usr/bin. The --ro flag makes the path read-only, and --rox makes it read-only plus execute.

```bash
landrun --rox /usr/bin --ro /home user-program
```

--------------------------------

### Run with network restrictions

Source: https://github.com/zouuup/landrun/blob/main/README.md

Runs a server that can only bind to TCP port 8080 and connect to TCP port 80.

```bash
landrun --rox /usr/ --ro /lib,/lib64 --bind-tcp 8080 --connect-tcp 80 /usr/bin/my-server
```

--------------------------------

### Minimal restricted run with landrun CLI

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/configuration.md

Runs `ls /etc` with read-only access to /usr and /etc, using best-effort mode and debug logging. Useful for a quick sandboxed command.

```bash
LANDRUN_LOG_LEVEL=debug landrun --best-effort --rox /usr --ro /etc ls /etc
```

--------------------------------

### Import internal/sandbox package

Source: https://github.com/zouuup/landrun/blob/main/_autodocs/api-reference/sandbox.md

Use this import to access the sandbox package from within the module. The package is internal and cannot be imported outside the module.

```go
import "github.com/zouuup/landrun/internal/sandbox"
```
Tokens:
Raw