Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS's Little-Known Command-Line Sandboxing Tool (2025)

igorstechnoclub.com

Post reply on HN
Print view View original

11–20 of 96 posts

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#11

Post by xyzzy_plugh »

It drives me nuts that sandbox-exec has "sandbox" in the name, since it's nothing like a real sandbox, and much closer to something like a high-level seccomp, and not much to do with "App Sandboxes" which is a distinct macOS feature.

IMO a real sandbox let's a program act how it wishes without impacting anything outside the sandbox. In reality many of these tools just cause hard failures when attempting to cross the defined boundaries.

It's also poorly documented and IIRC deprecated. I don't know what is supposed to replace it.

If macOS simply had overlay mounts in a sandbox then it would unlock so much. Compared to Linux containers (docker, systemd, bubblewrap, even unshare) macOS is a joke.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#13

Post by cwicklein »

kermatt wrote: post #8

Interesting config used a Scheme-like format. Any ideas on how that came to be?

I believe GUIX is implemented in Scheme which makes Scheme a natural choice for expressing configuration. Lisp tend to be a natural configuration format for anything written in Lisp. Highly functional configuration processing comes practically for free.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#14

Post by hmokiguess »

davidcann wrote: post #4

I made a UI for this to run terminal apps, like claude and codex: https://multitui.com

I’m impressed really neat work! Why did you opt for closed source?

edit: I don’t have a problem with closed source, but when software is expected to be accountable for my security I get a little paranoid, so was curious about the safety and guarantees here. The UX and everything else looks great

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#15

Post by epistasis »

kermatt wrote: post #8

Interesting config used a Scheme-like format. Any ideas on how that came to be?

I was given trauma from my decades of ELisp configuration for emacs...

Writing a parser for Lisp S-expressions is dead-simple, I wonder if that's why they used the format.

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#16

Post by _wire_ »

xyzzy_plugh wrote: post #11

It drives me nuts that sandbox-exec has "sandbox" in the name, since it's nothing like a real sandbox, and much closer to something like a high-level seccomp, and not much to do with "App Sandboxes" which is a distinct macOS feature. IMO a real sandbox let's a program act how it wishes without impacting anything outside the sandbox. In reality many of these tools just cause hard failures when attempting to cross the…

> If macOS simply had overlay mounts in a sandbox then it would unlock so much. Compared to Linux containers (docker, systemd, bubblewrap, even unshare) macOS is a joke.

You'll want to look into Homebrew (or Macports) for access to the larger world

Re: macOS's Little-Known Command-Line Sandboxing Tool (2025)

#20

Post by MillionOClock »

Someone wrote: post #7

https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... : “The sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide” That still is the case for MacOS 26.3 ( https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&aprop... ) MacOS 10.13.6 is from 2017, so this has been deprecated for almost 10 years.

I wonder how many major applications and tools depend on sandbox-exec today despite that depreciation, IIRC I can think of the Codex CLI and Swift Package Manager.
Post reply on HN