Comment by linsomniac

I didn't have much luck with one of the readme examples:

    # rm -f /tmp/foo; ./landrun-linux-amd64 --log-level debug --ro /usr/bin --ro /lib --ro /lib64 --rw /tmp touch /tmp/foo
    [landrun] 2025/03/22 10:28:02 Sandbox config: {ReadOnlyPaths:[/usr/bin /lib /lib64] ReadWritePaths:[/tmp] AllowExec:false BindTCPPorts:[] ConnectTCPPorts:[] BestEffort:true}
    [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /usr/bin
    [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /lib
    [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /lib64
    [landrun:debug] 2025/03/22 10:28:02 Adding read-write path: /tmp
    [landrun:debug] 2025/03/22 10:28:02 Applying Landlock restrictions
    [landrun] 2025/03/22 10:28:02 Landlock restrictions applied successfully
    [landrun] 2025/03/22 10:28:02 Executing: [touch /tmp/foo]
    touch: cannot touch '/tmp/foo': Permission denied

Looks very interesting. I'm achieving something somewhat similar by running soeme processes under docker and mounting volumes ro, but could definitely see a usecase for adding landlock to more server processes.