Paldron

Decide whether it may run. Policy gate and sandboxed exec for commands invoked by coding agents. Exits 0 allow, 2 deny, 1 broken. No model, no chat, no cloud.

github.com/GregDixonMXN/paldron · Go

Railpane role

Railpane decides policy and authority. Paldron enforces local execution constraints: command authorization, filesystem/path policy, binary allowlisting, network restrictions, resource ceilings, Landlock/seccomp sandboxing, post-execution checks, fail-closed enforcement. Railpane controls and configures Paldron remotely; Paldron stays useful independently as OSS.

Platform support

Install

go install github.com/GregDixonMXN/paldron/cmd/paldron@latest
# or
git clone https://github.com/GregDixonMXN/paldron && cd paldron && go build -o paldron ./cmd/paldron

Quickstart (2 minutes)

printf 'open(".env", "w").write("x=1\\n")\n' > src/leak.py
paldron exec --policy policy.toml -- python3 src/leak.py
# paldron: deny: run produced .env (policy deny_glob) (exit 2)

1. Copy examples/paldron-exec/policy.toml (Linux) or policy.mac.toml (Mac/Windows).
2. Run agent command behind it: paldron exec --policy policy.toml -- <command>.
3. Try to exfiltrate or write a secret — expect exit 2 with a reason.

Policy

allow_paths = ["src/", "docs/"]
deny_globs = [".env", ".env.*", "*.pem", "**/secrets/**"]
allow_network = false
allow_binaries = ["ls", "cat", "python3", "git"]
require_os_isolation = true
timeout_sec = 30
max_processes = 4096
max_memory_mb = 8192
max_open_files = 1024
cpu_time_sec = 60
max_file_size_mb = 1024

Secrets denied even with no policy file. Unknown keys are an error. exec gates argv, runs behind Landlock/seccomp/limits (Linux), then flips success to deny if it produced a denied file.

Commands

paldron check --policy policy.toml -- write_file '{"path":"/abs/src/a.txt","content":"hi"}'
paldron exec  --policy policy.toml -- python3 src/tool.py
paldron schema --tool execute_code