From 3294072d1e50a6315a234c7db6580a9081400b6d Mon Sep 17 00:00:00 2001
From: Ziad <153237520+Zierax@users.noreply.github.com>
Date: Sat, 6 Jun 2026 11:13:11 +0300
Subject: [PATCH] Add Z-Jail sandbox tool to README

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 1141141..213a68f 100644
--- a/README.md
+++ b/README.md
@@ -74,6 +74,7 @@ Projects using **Linux** security primitives (and a few Mac exceptions) such as
 | [syva](https://github.com/false-systems/syva) | eBPF, zones, kernel-enforcement | eBPF programs loaded per node that enforce zone-based boundaries between container groups — intercepts and denies cross-zone `open()`, `exec()`, `mmap()`, `ptrace()`, and `kill()` at the kernel level before they happen. Fills the gap namespaces leave: containers share a kernel, and namespaces alone don't stop cross-container ptrace or bind-mount file access. Declarative TOML policy (capabilities, memory/PID limits, network zones, filesystem paths, syscall deny list). No sidecar, no proxy. |
 | [Veto (Ona)](https://ona.com/docs/ona/organizations/policies/executable-deny-list) | BPF LSM, content-addressable | Content-addressable kernel enforcement using BPF LSM: blocks executables by SHA-256 hash of binary content (not path), pre-execution with no TOCTOU gap. The [deep dive on agent evasion of path-based controls](https://ona.com/stories/how-claude-code-escapes-its-own-denylist-and-sandbox) is a good read for anyone working with `bubblewrap`. |
 | [Hazmat](https://github.com/dredozubov/hazmat) | macOS, Seatbelt, PF firewall, isolated users, rollback | macOS-native runtime containment for AI agents and coding-agent workflows using isolated macOS users, Seatbelt sandboxing (`sandbox_init` via a privileged helper), PF firewall controls, DNS blocklists, backup/rollback, and a TLA+-checked design (44,795+ states across nine specs covering setup/rollback ordering, seatbelt policy, migration, tier policy equivalence, and helper fd isolation) to reduce host and network blast radius. |
+| [Z-Jail](https://github.com/Division-36/Z-Jail) | Linux namespaces, pivot_root, seccomp-BPF, capabilities | Lightweight ~130 KiB C99 sandbox with 7 ordered defense layers, 15-syscall whitelist, zero dependencies, and BLAKE2b-256 audit log for auditable execution of untrusted code. |
 
 For a structured approach to evaluating and comparing sandboxes, read [The Agent Sandbox Taxonomy](https://github.com/kajogo777/the-agent-sandbox-taxonomy). A few tools of potential interest:
 
@@ -248,4 +249,4 @@ Surveys, guides, and foundational literature on Linux security technologies appl
   - [Leveraging Kernel Security for Containers](https://dl.acm.org/doi/epdf/10.1145/3339252.3340502)
   - [Security Challenges in Container Cloud](https://www.researchgate.net/publication/359967351_Security_Challenges_in_the_Container_Cloud)
   - [SANDBOXESCAPEBENCH](https://arxiv.org/abs/2603.02277) finding that capable models can identify and exploit container escape vulnerabilities
-  - [User namespaces are not a security boundary](https://edera.dev/stories/user-namespaces-are-not-a-security-boundary): unprivileged user namespace sandboxes have a long history of kernel exploit vectors; layer additional controls (seccomp, Landlock, AppArmor/SELinux) when relying on them.
\ No newline at end of file
+  - [User namespaces are not a security boundary](https://edera.dev/stories/user-namespaces-are-not-a-security-boundary): unprivileged user namespace sandboxes have a long history of kernel exploit vectors; layer additional controls (seccomp, Landlock, AppArmor/SELinux) when relying on them.