#1152020 ITP: island -- user-friendly command-line sandboxing tool powered by Linux Landlock

#1152020#5
Date:
2026-10-25 14:50:00 UTC
From:
To:
* Package name    : island
  Version         : 0.0.0+git20260522.05a9d69
  Upstream Contact: Mickaël Salaün <mic@digikod.net>
* URL             : https://github.com/landlock-lsm/island
* License         : MIT or Apache-2.0
  Programming Lang: Rust
  Description     : user-friendly command-line sandboxing tool powered by Linux Landlock

Island makes the Landlock Linux Security Module practical for everyday
workflows. It runs existing, unmodified programs in a sandbox whose
filesystem, network and IPC access rights are described by declarative
TOML profiles.

Profiles are selected automatically from the current working directory
and can be layered (a more specific profile can only reduce the access
granted by its parents). Island also gives each workspace isolated XDG
and temporary directories, and provides an optional Zsh hook that
transparently sandboxes the commands typed in the shell. No root
privileges or special capabilities are needed.

* why is this package useful/relevant? is it a dependency for
  another package? do you use it? if there are other packages
  providing similar functionality, how does it compare?

 The archive already has per-invocation Landlock launchers: landrun and
  go-landlock's landlock-restrict, where the allowed paths and ports are
  given as command-line flags on every invocation.

  Island targets a different workflow: persistent, declarative profiles
  (in the Landlock Config format) bound to directories, chosen
  automatically from the current working directory, composable in layers,
  and combined with per-workspace XDG/TMPDIR isolation and a shell hook, so
  that commands run in a project are sandboxed without wrapping each one.
  It is developed by the Landlock kernel maintainers alongside the kernel
  feature and the "landlock" Rust crate (librust-landlock-dev), and is the
  tool the landlockconfig project itself recommends to end users.

  Packaging plan and dependencies:

  - Built with dh-cargo against the Debian Rust crate registry. All crate
    dependencies are already in unstable (clap 4.6, clap_complete 4.6,
    landlock 0.4.7, libc 0.2, serde 1.0, tempfile 3.27, thiserror 2.0,
    toml 0.8), except landlockconfig.
  - landlockconfig (same upstream, MIT or Apache-2.0) will be packaged
    first as rust-landlockconfig (librust-landlockconfig-dev) by the Debian
    Rust team in debcargo-conf, as soon as upstream publishes it on
    crates.io (only a 0.0.0 placeholder exists today). island will only be
    uploaded once rust-landlockconfig has been accepted into unstable.
  - Upstream has not tagged a release yet, hence the git snapshot version.
    Upstream describes the project as work in progress.

* how do you plan to maintain it? inside a packaging team
  (check list at https://wiki.debian.org/Teams)? are you
  looking for co-maintainers? do you need a sponsor?

 I plan to maintain this package myself on Salsa
 (https://salsa.debian.org/debian/island). I need a sponsor; the package
 will be uploaded to mentors.debian.net. Co-maintenance by the Debian Rust
 Team is welcome.