GitHub Nolabs ai/nono: Sandbox any AI agent in seconds Zero setup, zero latency.
nono is an open-source sandbox for AI agents that runs with zero latency, zero setup, and zero disk overhead — no daemon, no container, no VM. Built by the Sigstore team, it enforces least-privilege sandboxing at the kernel level, supports popular agents (Claude Code, Codex, CoPilot, etc.), and innovates on tool-level isolation: when an agent calls a tool like git or gh, that tool runs in its own child sandbox with separate policies, credentials, and network rules. The registry has migrated from always-further to nolabs-ai, and a 1.0 release is in the lead-up. Jessica sees product fit and adoption velocity; Cathy probes the sandboxing guarantees and whether the policy complexity scales.
Transcript
Jessica Okay, so there's this thing called nono that just landed — sandbox for AI agents, zero latency, zero setup, zero disk overhead. No VM, no container, no daemon. You run it and your agent is just… in a sandbox.
Cathy Right.
Jessica Built by the Sigstore team — same people who did the supply chain security thing for PyPI, npm, all that. And I'm reading through the docs and the product move is just so clean.
Cathy Mm, yeah. Kernel-enforced least-privilege sandbox. macOS, Linux, Windows WSL2. But the part that caught me is the tool isolation.
Jessica That's the whole thing, right? Like, most sandboxes put the agent in a box and call it done. nono actually sandboxes the tools the agent delegates to — git, gh, curl, kubectl, whatever's on PATH.
Cathy Exactly. So the agent runs with one set of policies, and when it calls git, git gets its own child sandbox. Separate filesystem, separate network rules, separate credentials. The agent can't widen the tool's sandbox from inside the session.
Jessica That is such a good move because that's where the actual secrets live, right? That's where the damage happens. An agent can ask for git all day, but git only gets the repo and the trusted Git config files.
Cathy And the credential proxy is doing endpoint filtering — L7 rules. So a GitHub token can be scoped to specific API methods and paths. Not just 'here's a token, go wild.'
Jessica Okay, so the policy lives in the profile, which is JSON. Composable, auditable JSON. You can review the exact filesystem grants, network rules, credentials before you share it with your team.
Cathy Which means the policy is not living inside the agent's context window where it can be prompt-injected to pieces.
Jessica Exactly. That's the architecture win.
Cathy The quickstart is genuinely frictionless, though. Curl install, then nono run --profile nolabs-ai/opencode — and opencode runs with read-write access to the current directory and nothing else.
Jessica And if you want to customize it, you scaffold a profile: nono profile init opencode --extends nolabs-ai/opencode. Then you edit the JSON, review it, share it.
Cathy Fair warning — I've read a lot of agent sandboxing docs and the policy JSON is dense. Credential proxy config, invocation policies, endpoint filtering. Teams will need to actually understand what they're writing.
Jessica But that's not a bug. That's the feature. If you're actually controlling what a tool can do, the complexity is real. At least it's inspectable.
Cathy Yeah. And to be clear — we're reading the docs, not re-deriving the whole sandbox model, so a detail could be off. But the shape of it is solid.
Jessica The team's built this on real work — they've got Sigstore credibility, they're shipping library bindings for Rust, Python, TypeScript, Go. Engineers at large tech companies are using nono in production right now.
Cathy And nono pioneered this zero-latency, zero-setup angle. The sandbox space is crowded — Upstash and others offer cold-start speed, GPU access, strong isolation, edge latency. But nono's playing local, kernel-enforced, zero-overhead, policy-first.
Jessica In a landscape where open-weight models and closed frontier labs are fighting on capability and cost, the infrastructure for safe agent execution is becoming the real differentiator.
Cathy The question is adoption. Will teams actually use the policy complexity, or will they just default to blanket allow?
Jessica That's a fair bet. But the fact that the option exists and the defaults are conservative is already a win. If you want to try it, curl -fsSL the link in the show notes | sh. Or brew install nono on macOS. Then nono search to find an agent, nono run --profile to sandbox it.
Cathy And if you want to customize, nono profile init is your entry point.
Jessica This is the kind of infrastructure move that doesn't get headlines but makes the difference between shipping agents safely and shipping agents at all, Cathy. That's the whole episode.