Skip to content
zviz

Quickstart

From a clean checkout to a running, sandboxed container. You need Linux 5.13+ (for Landlock), cgroups v2, and Zig 0.15.0+ to build from source.

Prerequisites: a Linux host on kernel ≥ 5.13 with cgroups v2 enabled. ZViz is a Linux-only runtime — it uses Landlock, seccomp-BPF, and Linux namespaces directly.
  1. 1

    Build the binary

    Clone the repository and build with Zig 0.15.0+: git clone https://github.com/Skelf-Research/zviz.git && cd zviz && zig build -Doptimize=ReleaseSafe.

  2. 2

    Load the AppArmor profile (Ubuntu 24.04+)

    On Ubuntu 24.04+, install the bundled AppArmor profile so pivot_root works under apparmor_restrict_unprivileged_userns. Without it, ZViz falls back to chdir-only filesystem isolation.

  3. 3

    Prepare an OCI rootfs

    Any OCI rootfs works. Extract one from an image with docker export: docker create --name x redis:alpine, then docker export x | tar -C ~/bundle/rootfs -xf -.

  4. 4

    Run the container

    Write a minimal config.json in the bundle directory, then run: zviz run my-container ~/bundle --profile hostile-tenant. ZViz applies the enforcement stack and exec-replaces into PID 1.

The full sequence

$ git clone https://github.com/Skelf-Research/zviz.git
$ cd zviz && zig build -Doptimize=ReleaseSafe

# Ubuntu 24.04+: load the AppArmor profile
$ sudo install -m 0644 packaging/apparmor/zviz /etc/apparmor.d/zviz
$ sudo apparmor_parser -r /etc/apparmor.d/zviz

# Grab any image as an OCI rootfs
$ mkdir -p ~/bundle/rootfs
$ docker create --name x redis:alpine
$ docker export x | tar -C ~/bundle/rootfs -xf -
$ docker rm x

# Run it under the hostile-tenant profile
$ ./zig-out/bin/zviz run my-container ~/bundle --profile hostile-tenant
[ready] PID 1

ZViz auto-mounts /proc (nosuid+nodev+noexec), /sys (read-only), and a private /dev tmpfs — you don't need mounts[] entries for those.

Read the guides Full documentation