SysCage is a Linux sandbox written in Bash. It runs untrusted binaries inside an isolated environment using native kernel features: Linux namespaces (PID, Mount, Network, UTS, IPC), pivot_root, cgroups v2, and syscall tracing via strace.
The sandbox builds a minimal rootfs in a tmpfs, resolves and copies all required shared libraries, drops privileges to an unprivileged user, and captures full syscall logs, network traffic, TTY output, and memory dumps for post-execution analysis.
Isolated rootfs built on tmpfs (no host filesystem exposure)
PID, Mount, Network, UTS and IPC namespace isolation
Syscall tracing with strace (file, process, network, signal)
Anti-ptrace and sleep-bypass injection
Anti-VM hardware decoys (DMI/cpuinfo spoofing)
Network isolation (none) or controlled interception (veth + tcpdump)
GUI support via Xephyr (nested X server)
TTY capture, memory dump, and artifact quarantine
Bilingual output (English by default, Spanish with --esp)
Resource limits via cgroups v2 or systemd-run
Root privileges Linux kernel with namespace support (>= 3.8) strace, unshare, pivot_root, mount, objdump, ip, file, find, coreutils
Optional: tcpdump, gdb, busybox, Xephyr, python3, script
Run install.sh to check and install all dependencies automatically.
sudo ./syscage.sh /path/to/binary [--gui] [--net none|veth] [--quarantine /path]
Wine mode (.exe support) is under active development. The sandbox detects PE32 binaries and activates Wine automatically, but library resolution inside the isolated namespace is not yet stable. Native Linux binaries work correctly. 😛