Landlock LSM on Fly Machines?

Questions / Help
1

Hi. We run an agent sandbox (NVIDIA OpenShell) that needs the Landlock LSM, ABI v3 or newer. On a Machine with kernel 6.12.114-fly, /sys/kernel/security/lsm shows only capability,selinux, and landlock_create_ruleset returns ENOSYS. So the sandbox refuses to start.

Three questions:

  1. Is Landlock (CONFIG_SECURITY_LANDLOCK, enabled in the LSM list) available on any Machine type or region, or planned?
  2. If not, can a Machine run with a different kernel or kernel options?
  3. Is nested virtualization (KVM inside a Machine) available, as a fallback for a microVM-based sandbox?

Thanks.

2

Hi , thanks for reaching out!

  1. Landlock is not available on Fly machines at all. Availability is not planned or in the roadmap.
  2. Not at this time, all guests use the same kernel. There’s limited ability to set boot-time kernel args but YMMV. https://docs.fly.io/reference/configuration#kernel_args
  3. No, nested virtualization is not supported on Fly machines.

Cheers!