Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)

Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager. | Actively sponsored by our friends at TestMu AI

Curated resources help you prepare for the CNCF/Linux Foundation CKS 2021 "Kubernetes Certified Security Specialist" Certification exam. Please provide feedback or requests by raising issues, or making a pull request. All feedback for improvements are welcome. thank you.

Provide powerful tools for seccomp analysis

Lightweight, container-free sandbox for running commands with network and filesystem restrictions

The main libseccomp repository

A stupid game for learning about containers, capabilities, and syscalls.

The Kubernetes Security Profiles Operator

vArmor is a cloud-native container hardening system that leverages AppArmor/BPF/Seccomp and NetworkProxy technologies to enforce access control from system calls to application protocols — protecting workloads including AI Agents.

The lightest AI sandbox. A process-based sandbox for Linux, no container, no VM, no privilege, no prompt injection

a fast, rootless container runtime and sandbox with no daemon. It runs workloads, including agent tool calls and code generated by an LLM, in real containers enforced by the kernel.

Tool and framework for securely reading untrusted USB mass storage devices.

minT(oolkit): Mint awesome, secure and production ready containers just the way you need them! Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)

The libseccomp golang bindings repository

Container-free, deny-by-default sandbox for AI coding agents. Kernel-enforced filesystem, network, and syscall isolation for Linux and macOS

A set of curated exercises to help you prepare for the CKS exam

Library-Level eBPF Sandbox for Python (Linux & macOS): syscall-level control per module.

🔍 Function-level tracing tool for Seccomp profiling, with eBPF

Rust implementation of PRoot, a ptrace-based sandbox

Generate seccomp profiles from go binaries