macOS's Little-Known Command-Line Sandboxing Tool (2025)
igorstechnoclub.com
macOS's Little-Known Command-Line Sandboxing Tool (2025)
1–10 of 96 posts
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#2Thanks for putting this together, it's very helpful.
Readers may also be interested in https://github.com/eugene1g/agent-safehouse> which was open sourced after a recent HN conversation https://news.ycombinator.com/item?id=46923436>.
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#3Nice write-up! This is one component of a much larger umbrella framework for security on Apple platforms:
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#4I made a UI for this to run terminal apps, like claude and codex: https://multitui.com
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#5Do any of the third-party package managers (Brew, MacPorts) perhaps use this for things like builds (or even installs, if things are restricted to (e.g.) /opt)?
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#6Do any of the third-party package managers (Brew, MacPorts) perhaps use this for things like builds (or even installs, if things are restricted to (e.g.) /opt)?
I’ve written a personal system in Common Lisp for building third-party software on macOS (coincidentally somewhat similar to GUIX), and I use sandbox-exec to isolate execution so that only intended requisites affect the build process and so that installation is strictly confined to the configured destination directory, no scribbling outside the lines.
I think Bazel uses sandbox-exec on macOS.
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#7https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop...:
“The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide”
That still is the case for MacOS 26.3 (https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop...)
MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#8Interesting config used a Scheme-like format. Any ideas on how that came to be?
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#9I made a UI for this to run terminal apps, like claude and codex: https://multitui.com
I like this! I built something similar for sandboxing CLI agents, and in the repo have a collection of minimal profiles for sandbox-exec to use - https://agent-safehouse.dev/
Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)
#10Both Claude Code and Codex use sandbox-exec with Seatbelt to sandbox execution:
- https://developers.openai.com/codex/security/#os-level-sandb...