How does the Line CLI sandbox work on Linux?
On Linux, Line can sandbox the shell commands it runs using a kernel feature called Landlock. With the sandbox on, commands can write only to your project folder, temporary folders and tool cache folders.
Turn it on#
- One run:
line --sandbox on(orauto) - Always:
"sandbox": "auto"in~/.config/line/settings.json - Extra writable folders:
"sandbox_writable": ["~/.gradle"] - Block TCP network for commands:
"sandbox_network": false(needs Linux kernel 6.7 or newer)
Good to know#
- Off by default. It applies to shell commands only.
autouses the sandbox when your system supports it;oninsists on it.- Older kernels may not support every restriction.
Related articles
Still need help?
Tried the steps above and still stuck? Email us. We usually reply within the first hour, and always within 24 hours. A full support team is with you.
Infrastructure questions, or permanent deletion of your data
infrastructure@clatterlabs.xyzFor deleting your whole account or the data of one service.