Linux Landlock
The preferred Linux backend — zero external dependencies on kernel 5.13+.
What is Linux Landlock?
Landlock is the preferred Linux sandbox backend for Watchfire. It's a kernel Linux Security Module — available on every kernel 5.13 or newer — which means agents are fenced at the syscall layer without any external dependency.
Linux Landlock + Watchfire
When you start a session on a recent Linux kernel, Watchfire re-execs into a small helper process, applies Landlock filesystem rules, then exec's the agent. From that moment on the agent (and everything it spawns) sees a restricted view of the filesystem: writes scoped to the worktree, sensitive paths unreadable, and the rules can't be unset from user space.
Compared to Bubblewrap and other namespace-based sandboxes, Landlock is lower-cost and more honest — there's no mount namespace to break out of, and no privileged setup. The kernel does the work.
If Landlock is disabled or unavailable on your kernel, Watchfire falls back to Bubblewrap automatically. You can pin one or the other in project.yaml when you want the build to fail loudly instead of degrading silently.
Setup
Watchfire detects Landlock support automatically. Pin it explicitly when you want startup to fail loudly on an older kernel.
# .watchfire/project.yaml
sandbox: landlock # require Landlock; refuse to start without itGet started with Watchfire
Install in seconds. Define tasks. Let agents ship code for you.
Download for macOSAvailable for macOS, Linux, and Windows
# Install via Homebrew (macOS)brew tap watchfire-io/tapbrew install --cask watchfire-io/tap/watchfire# Set up your project and gowatchfire initwatchfire task add "Build the login page"watchfire start --allIncludes GUI, CLI, and daemon. Also available via Homebrew.