> ## Documentation Index
> Fetch the complete documentation index at: https://nono.sh/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Go SDK

> CGo bindings for applying nono capability sandboxes from Go applications

`nono-go` provides Go bindings for the nono capability-based security sandbox.
It lets a Go process declare the filesystem and network access it needs, then
apply an irreversible kernel-enforced sandbox to itself and its child processes.

The package uses the nono C FFI underneath:

* Linux enforcement uses Landlock.
* macOS enforcement uses Seatbelt through `sandbox_init`.
* Static libraries are bundled for macOS and Linux on `amd64` and `arm64`.
* The public API is available at [pkg.go.dev/github.com/nolabs-ai/nono-go](https://pkg.go.dev/github.com/nolabs-ai/nono-go).

## Install

```bash theme={null}
go get github.com/nolabs-ai/nono-go
```

## Requirements

* Go 1.24 or newer
* CGo enabled
* A C toolchain such as `clang` or `gcc`

## Platform support

| OS | Architecture | Bundled library |
| - | - | - |
| macOS | `arm64` | Yes |
| macOS | `amd64` | Yes |
| Linux | `amd64` | Yes |
| Linux | `arm64` | Yes |

Unsupported platforms compile to stubs that report `nono.ErrUnsupportedPlatform`.

## Core concepts

`CapabilitySet` builds the policy: allowed paths, access modes, network mode,
command rules, and optional platform-specific rules.

`Apply` activates the sandbox for the current process. This is irreversible.
Once applied, the process and its children can only access resources allowed by
the capability set.

`QueryContext` checks whether a capability set would allow a filesystem or
network operation without applying the sandbox.

`SandboxState` serializes a capability set to JSON and restores it later.

## Next steps

> [card] [Quickstart](https://nono.sh/docs/go/quickstart.md)
>
> Install the package and apply a minimal sandbox

> [card] [CapabilitySet](https://nono.sh/docs/go/api/capability-set.md)
>
> Build filesystem and network permissions

> [card] [QueryContext](https://nono.sh/docs/go/api/query-context.md)
>
> Test permissions before applying a sandbox

> [card] [Bundled Libraries](https://nono.sh/docs/go/bundled-libraries.md)
>
> Understand how native FFI artifacts are tracked


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.