Kernel and Landlock requirements

ZViz leans on specific kernel features. This guide lists what it needs and what degrades if a requirement is missing.

The requirements

• Linux kernel ≥ 5.13 — for the Landlock LSM.
• cgroups v2 enabled — for per-container resource limits.
• Zig 0.15.0+ — to build ZViz from source.

Why Landlock needs 5.13

Landlock is an unprivileged Linux Security Module that lets a process sandbox its own filesystem access with a ruleset. It landed in Linux 5.13. ZViz applies a Landlock ruleset as one of its five enforcement layers.

On a kernel older than 5.13, ZViz cannot apply Landlock and falls back to chdir-only filesystem isolation, which is weaker. For untrusted workloads, run on 5.13+ so the Landlock layer is in place.

Ubuntu 24.04+ and unprivileged user namespaces

Ubuntu 24.04 restricts unprivileged user namespaces by default (apparmor_restrict_unprivileged_userns=1). To keep pivot_root working, install the bundled AppArmor profile:

sudo install -m 0644 packaging/apparmor/zviz /etc/apparmor.d/zviz
sudo apparmor_parser -r /etc/apparmor.d/zviz

Without it, ZViz again falls back to chdir-only filesystem isolation.

Confirming your host

Check the kernel version and that cgroups v2 is mounted before running untrusted work. If either requirement is unmet, ZViz still runs but with reduced filesystem isolation — which you do not want for a hostile workload.

Related

• Build from source and run your first container
• Tuning cgroups v2 limits
• Threat model