Landlock

Landlock is a Linux security mechanism that applications can use to restrict their own access to system resources.

[!NOTE]

Landlock is an advanced feature for Linux runners. Enable it when a tool or workload requires Landlock. Enabling it makes Landlock available; it does not automatically sandbox your workflow. Your application or sandboxing tool must apply its own Landlock restrictions.

See the Runner Controls overview for how to pass settings via a profile or labels.

With runner profiles

Append ;linux.landlock=enabled to your Linux runner profile label:

runs-on: "namespace-profile-your-profile;linux.landlock=enabled"

Replace your-profile with your profile name.

With runner labels

Add namespace-features:linux.landlock=enabled and use the -with-features suffix on your machine label:

runs-on:
  - nscloud-ubuntu-24.04-amd64-2x4-with-features
  - "namespace-features:linux.landlock=enabled"