* Package name : island
Version : 0.0.0+git20260522.05a9d69
Upstream Contact: Mickaël Salaün <mic@digikod.net>
* URL : https://github.com/landlock-lsm/island
* License : MIT or Apache-2.0
Programming Lang: Rust
Description : user-friendly command-line sandboxing tool powered by Linux Landlock
Island makes the Landlock Linux Security Module practical for everyday
workflows. It runs existing, unmodified programs in a sandbox whose
filesystem, network and IPC access rights are described by declarative
TOML profiles.
Profiles are selected automatically from the current working directory
and can be layered (a more specific profile can only reduce the access
granted by its parents). Island also gives each workspace isolated XDG
and temporary directories, and provides an optional Zsh hook that
transparently sandboxes the commands typed in the shell. No root
privileges or special capabilities are needed.
* why is this package useful/relevant? is it a dependency for
another package? do you use it? if there are other packages
providing similar functionality, how does it compare?
The archive already has per-invocation Landlock launchers: landrun and
go-landlock's landlock-restrict, where the allowed paths and ports are
given as command-line flags on every invocation.
Island targets a different workflow: persistent, declarative profiles
(in the Landlock Config format) bound to directories, chosen
automatically from the current working directory, composable in layers,
and combined with per-workspace XDG/TMPDIR isolation and a shell hook, so
that commands run in a project are sandboxed without wrapping each one.
It is developed by the Landlock kernel maintainers alongside the kernel
feature and the "landlock" Rust crate (librust-landlock-dev), and is the
tool the landlockconfig project itself recommends to end users.
Packaging plan and dependencies:
- Built with dh-cargo against the Debian Rust crate registry. All crate
dependencies are already in unstable (clap 4.6, clap_complete 4.6,
landlock 0.4.7, libc 0.2, serde 1.0, tempfile 3.27, thiserror 2.0,
toml 0.8), except landlockconfig.
- landlockconfig (same upstream, MIT or Apache-2.0) will be packaged
first as rust-landlockconfig (librust-landlockconfig-dev) by the Debian
Rust team in debcargo-conf, as soon as upstream publishes it on
crates.io (only a 0.0.0 placeholder exists today). island will only be
uploaded once rust-landlockconfig has been accepted into unstable.
- Upstream has not tagged a release yet, hence the git snapshot version.
Upstream describes the project as work in progress.
* how do you plan to maintain it? inside a packaging team
(check list at https://wiki.debian.org/Teams)? are you
looking for co-maintainers? do you need a sponsor?
I plan to maintain this package myself on Salsa
(https://salsa.debian.org/debian/island). I need a sponsor; the package
will be uploaded to mentors.debian.net. Co-maintenance by the Debian Rust
Team is welcome.