Zoup

Fair, KPI for software engineering is shit distilled.

I've been working on a small tool that analyzes GitHub pull requests - not to measure speed or volume, but to find deep, high-quality contributions that often get missed in day-to-day reviews.

It’s especially useful at the skip-level, where some of the most impactful engineers can easily be overlooked.

Would love feedback if this is something that resonates with how you're thinking about team performance.

It's called Veritum: https://veritum.ai (free trial, no credit card), DM me if you need extra credits!

V0.1.11 out, with env support and bunch of other fixes, update!

Thanks!

they can be jailed by landlock, we don't have support in go-landlock tho afaik, @Gnoack

well yeah maybe, if you like.

ROX isn't self-contradictory, Allowing read() and execve(), but denying write() and truncate() are totally valid and common in secure execution contexts, although things gets worse with directory traverse.

So yeah, --rox is fine semantically, just ugly. :D

good catch, fixed.

give it a try with v0.10: landrun --rox /usr/ --ro /usr/lib ls /usr/bin/

Thank you all for your support, I really didn't expect this to take off like this! given that project is roughly two days old (:D) it's still fair to expect some issues all around, please report them on GH if you found one.

it's recursive by default

yeah it wasn't the best call, have a look at v0.1.4, I think it's better now!

in this case doesn't have access to "a" wherever it is...

$ landrun --ro /usr cat /usr/bin/ls | wc -l

400

executing ls (as in actual binary execution) will require --exec

$ landrun --ro /usr ls /usr/bin/

ls: cannot open directory '/usr/bin/': Permission denied

$ landrun --ro /usr --exec ls /usr/bin/

list of billions of files

note that I don't really love the --exec thingy, if it's not "on" by default it's just for sake of being explicit.

Update: there's a bug to limit "file access", which I'll fix asap.

Update2: Adding a --exec-path instead to limit executable, it wasn't the best idea to have a global --exec anyway

Update3: Have a look at V0.1.4, I think it's far cleaner now.

running cat isn't a --exec for one :)

V0.1.3 is out now!

haha, why!

Great job on the lib, thank you!

well yeah you'll need --exec when you want to run binaries (unlike... cat?) I hope landlock adds support to bind --exec to actual directories, that'll be fun!

yeah you are missing --exec there, which feels a bit useless that you have to mention it, but I prefer things explicit and use all LSM can provide, I can imagine cases where --exec isn't really required. like `cat`.

either case have a look at latest release, it's a bit cleaner.

Yeah I agree with that, just release a new version that does that.

Linux Landlock is a kernel-native security module that lets unprivileged processes sandbox themselves - but nobody uses it because the API is ... hard!

I built `landrun`, a small CLI tool in Go, to make it practical to sandbox any command with fine-grained filesystem and network access controls. No root. No containers. No SELinux/AppArmor configs.

It's lightweight, auditable, and wraps Landlock v5 features (file access + TCP restrictions).

Demo + usage examples in the README.

Would love feedback from the HN crowd!