Landlock is a simple, unprivileged, deny-by-default sandboxing mechanism for Linux. It’s easy to understand, easy to integrate, and has tremendous potential for improving desktop and application security. Because Landlock requires no privileges to use, adding it to most programs is straightforward. Bindings exist for languages such as Rust, Go, and Haskell, and several projects provide user-friendly unveil-style wrappers.