Division-36 released Z-Jail, a lean Linux sandbox for executing code securely. It packs seven distinct defense layers into a tiny ~130 KiB binary, eschewing external dependencies. Z-Jail bridges the gap between minimal tools like bwrap and heavier options, targeting CI pipelines and competitive programming environments that need robust isolation without full container runtimes.

Z-Jail employs namespaces (mount, pid, net, ipc, uts), pivot_root, capability dropping, and `PR_SET_NO_NEW_PRIVS` to isolate processes. Its core security relies on a seccomp-BPF filter that whitelists a mere 15 system calls. An evidence-based verdict engine, Truthimatics, analyzes execution, logging results in JSON with BLAKE2b hashes for binary integrity verification.

This tool offers a compelling alternative for developers demanding deep system isolation. By combining multiple security mechanisms, Z-Jail provides defense-in-depth. Its minimal footprint and lack of dependencies make it practical for environments where resource constraints are a concern, ensuring auditable code execution. The project's roadmap indicates further development is planned.