Greywall Sandbox

Greywall is a container-free, deny-by-default sandbox designed to secure AI agents with real-time observability and dynamic kernel-level controls.

Greywall provides a high-fidelity security layer for CLI agents and untrusted tools without the overhead of Docker or virtual machines. By leveraging OS-native primitives like Landlock for filesystem enforcement, Seccomp BPF for syscall filtering, and Bubblewrap for process isolation, it wraps commands in a strict environment that remains transparent to the user. The platform distinguishes itself through Greyproxy, a network observability tool that captures outbound traffic at the kernel level (via TUN devices) to allow or deny connections in real time. With features like learning mode for automatic filesystem discovery and built-in profiles for agents like Claude, Aider, and Cursor, Greywall eliminates the friction of manual configuration while maintaining a robust defense against unauthorized data exfiltration or system tampering.

https://greywall.io