Experimented with a FUSE filesystem sandbox for greywall. Gave up on Landlock, wanted dynamic rules and actual observability instead of a black box.
Rules are simple: "only git can touch .git/**". First match wins. Runs rootless, no sudo. Every file operation streams as JSONL.
No, Claude can't read your .env. But if it needs git? Fine, that's allowed. Per-caller semantics feel like the right direction for agent sandboxing.









