← Back to Labs
Build a container, one primitive at a time
Toggle namespaces, capabilities, cgroup limits, seccomp, and pivot_root. Each control maps to a real Linux isolation primitive.
0/100Isolation score
Start with an ordinary process that shares the host. Unshare namespaces, drop capabilities, add limits, and watch which kernel boundaries actually create isolation.
Shortcuts: C preset · P pivot · S seccomp · L launch · X reset
Tap the controls to build the sandbox.