Agent Safehouse – macOS-native sandboxing for local agents
agent-safehouse.dev
Agent Safehouse – macOS-native sandboxing for local agents
1–10 of 207 posts
Re: Agent Safehouse – macOS-native sandboxing for local agents
#2While we have `sandbox-exec` in macOS, we still don't have a proper Docker for macOS. Instead, the current Docker runs on macOS as a Linux VM which is useful but only as a Linux machine goes.
Having real macOS Docker would solve the problem this project solves, and 1001 other problems.
Re: Agent Safehouse – macOS-native sandboxing for local agents
#3This is just a wrapper around sandbox-exec. It's nice that there are a ton of presets that have been thought out, since 90% of wielding sandbox-exec is correctly scoping it to whatever the inner environment requires (the other 90% is figuring out how sandbox-exec works).
I like that it's just a shell script.
I do wish that there was a simple way to sandbox programs with an overlay or copy-on-write semantics (or better yet bind mounts). I don't care if, in the process of doing some work, an LLM agent modifies .bashrc -- I only care if it modifies _my_ .bashrc
Re: Agent Safehouse – macOS-native sandboxing for local agents
#4so this works the same as Claude Code /sandbox? The innovation being that it's harness-agnostic?
Re: Agent Safehouse – macOS-native sandboxing for local agents
#5While we have `sandbox-exec` in macOS, we still don't have a proper Docker for macOS. Instead, the current Docker runs on macOS as a Linux VM which is useful but only as a Linux machine goes. Having real macOS Docker would solve the problem this project solves, and 1001 other problems.
Nitpick, which probably doesn't matter too much in this context but is always good to remember: Docker containers are not security boundaries.
Re: Agent Safehouse – macOS-native sandboxing for local agents
#6While we have `sandbox-exec` in macOS, we still don't have a proper Docker for macOS. Instead, the current Docker runs on macOS as a Linux VM which is useful but only as a Linux machine goes. Having real macOS Docker would solve the problem this project solves, and 1001 other problems.
Apple containers were released a few months back. Been using it to sandbox claude/gemini-cli generated code[1].
You can use it to completely sandbox claude code too.
1. Coderunner - https://github.com/instavm/coderunner
Re: Agent Safehouse – macOS-native sandboxing for local agents
#7Creator here - didn't expect this to go public so soon. A few notes:
1. I built this because I like my agents to be local. Not in a container, not in a remote server, but running on my finely-tuned machine. This helps me run all agents on full-auto, in peace.
2. Yes, it's just a policy-generator for sandbox-exec. IMO, that's the best part about the project - no dependencies, no fancy tech, no virtualization. But I did put in many hours to identify the minimum required permissions for agents to continue working with auto-updates, keychain integration, and pasting images, etc. There are notes about my investigations into what each agent needs https://agent-safehouse.dev/docs/agent-investigations/ (AI-generated)
3. You don't even need the rest of the project and use just the Policy Builder to generate a single sandbox-exec policy you can put into your dotfiles https://agent-safehouse.dev/policy-builder.html
Re: Agent Safehouse – macOS-native sandboxing for local agents
#8While we have `sandbox-exec` in macOS, we still don't have a proper Docker for macOS. Instead, the current Docker runs on macOS as a Linux VM which is useful but only as a Linux machine goes. Having real macOS Docker would solve the problem this project solves, and 1001 other problems.
What would native containers bring over Linux ones? The performance of VZ emulation is good, existing tools have great UX, and using a virtualized kernel is a bit safer anyways. I regularly use a Lima VM as a VSCode remote workspace to run yolo agents in.
Re: Agent Safehouse – macOS-native sandboxing for local agents
#9While we have `sandbox-exec` in macOS, we still don't have a proper Docker for macOS. Instead, the current Docker runs on macOS as a Linux VM which is useful but only as a Linux machine goes. Having real macOS Docker would solve the problem this project solves, and 1001 other problems.
Apple containers were released a few months back. Been using it to sandbox claude/gemini-cli generated code[1]. You can use it to completely sandbox claude code too. 1. Coderunner - https://github.com/instavm/coderunner
That is also Linux VM on MacOS. They're not MacOS containers..
So it's completely pointless / useless for MacOS or iOS development
Re: Agent Safehouse – macOS-native sandboxing for local agents
#10so this works the same as Claude Code /sandbox? The innovation being that it's harness-agnostic?
That and that the built in sandbox in Claude Code is bad (read only access to everything by default) and tightly coupled (cant modify it or swap it out).