# Landlock LSM on Fly Machines?

**URL:** <https://community.fly.io/t/landlock-lsm-on-fly-machines/28921>\
**Category:** Questions / Help\
**Created:** [October 25, 2026, 7:47pm UTC](https://community.fly.io/t/landlock-lsm-on-fly-machines/28921 "2026-10-25T19:47:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ZalmyAI](https://avatars.discourse-cdn.com/v4/letter/z/ecae2f/32.png) [@ZalmyAI](https://community.fly.io/u/ZalmyAI)\
**Post date:** [October 25, 2026, 7:47pm UTC](https://community.fly.io/t/landlock-lsm-on-fly-machines/28921/1 "2026-10-25T19:47:17Z")

</div>

Hi. We run an agent sandbox (NVIDIA OpenShell) that needs the Landlock LSM, ABI v3 or newer. On a Machine with kernel 6.12.114-fly, `/sys/kernel/security/lsm` shows only `capability,selinux`, and `landlock_create_ruleset` returns ENOSYS. So the sandbox refuses to start.

Three questions:

1. Is Landlock (CONFIG\_SECURITY\_LANDLOCK, enabled in the LSM list) available on any Machine type or region, or planned?
2. If not, can a Machine run with a different kernel or kernel options?
3. Is nested virtualization (KVM inside a Machine) available, as a fallback for a microVM-based sandbox?

Thanks.

---

<div class="post-metadata">

**Author:** ![flyio-support](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/flyio-support/32/46245_2.png) [@flyio-support](https://community.fly.io/u/flyio-support)\
**Post date:** [October 27, 2026, 2:29pm UTC](https://community.fly.io/t/landlock-lsm-on-fly-machines/28921/2 "2026-10-27T14:29:52Z")

</div>

Hi , thanks for reaching out!

1. Landlock is not available on Fly machines at all. Availability is not planned or in the roadmap.
2. Not at this time, all guests use the same kernel. There’s limited ability to set boot-time kernel args but YMMV. [https://docs.fly.io/reference/configuration#kernel\_args](https://docs.fly.io/reference/configuration#kernel_args)
3. No, nested virtualization is not supported on Fly machines.

Cheers!