{"slug": "sandbox-exec", "name": "sandbox-exec", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 5, "commenters": 14, "warners": 1, "score": 5.576, "rising": -1.64, "first": "2025-11-13", "latest": "2026-10-13", "why": "OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 8, "compare": 0, "warn": 1}, "spark": [0, 0, 2, 2, 0, 0, 0, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec.", "kind": "", "icon": false, "domain": "igorstechnoclub.com", "github_repo": null, "official_url": "", "pricing": "", "aliases": ["sandbox-exec"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 782435538, "item_id": 48902221, "url": "https://news.ycombinator.com/item?id=48902221", "by": "kirtivr", "date": "2026-07-13", "version": null, "stance": "recommend", "quote": "OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec.", "excerpt": "On Linux, we rely on a chroot-ed workspace at this time - although we are working on a prototype using the new landlock kernel interface (https://github.com/Zouuup/landrun). OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec. For Windows, we use WSL containers when available. By default, if a safe sandbox environment is not available, we inform the user that a repro is not possible in the curren", "context": "", "use_case": "macOS sandboxing", "switched_from": "", "story": "Show HN: FixBugs \u2013 Reproduce production bugs and verify fixes"}, {"id": 753936816, "item_id": 47121051, "url": "https://news.ycombinator.com/item?id=47121051", "by": "user3939382", "date": "2026-02-23", "version": null, "stance": "recommend", "quote": "macos also has a native sandbox-exec that can be used to isolate processes with a policy you like.", "excerpt": "macos also has a native sandbox-exec that can be used to isolate processes with a policy you like. https://igorstechnoclub.com/sandbox-exec/", "context": "", "use_case": "Process isolation on macOS", "switched_from": "", "story": "Show HN: Local-First Linux MicroVMs for macOS"}, {"id": 753625280, "item_id": 47101580, "url": "https://news.ycombinator.com/item?id=47101580", "by": "cwicklein", "date": "2026-02-21", "version": null, "stance": "recommend", "quote": "I use sandbox-exec to isolate execution", "excerpt": "I\u2019ve written a personal system in Common Lisp for building third-party software on macOS (coincidentally somewhat similar to GUIX), and I use sandbox-exec to isolate execution so that only intended requisites affect the build process and so that installation is strictly confined to the configured destination directory, no scribbling outside the lines. I think Bazel uses sandbox-exec on macOS.", "context": "", "use_case": "isolating build execution", "switched_from": "", "story": "macOS's Little-Known Command-Line Sandboxing Tool"}, {"id": 747146273, "item_id": 46696642, "url": "https://news.ycombinator.com/item?id=46696642", "by": "YaeGh8Vo", "date": "2026-01-20", "version": null, "stance": "recommend", "quote": "sandbox-exec (macOS) is probably enough and also much less overhead", "excerpt": "In my experience, a simple bubblewrap (Linux) or sandbox-exec (macOS) is probably enough and also much less overhead. LLMs agents are not exploiting kernels to get out of the sandbox. The most common issues are them trying to open PRs, or changing files where they shouldn't. - https://github.com/numtide/claudebox", "context": "", "use_case": "Sandboxing agent processes", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}, {"id": 747080369, "item_id": 46692523, "url": "https://news.ycombinator.com/item?id=46692523", "by": "woof", "date": "2026-01-20", "version": null, "stance": "recommend", "quote": "sandbox-exec on MacOS", "excerpt": "sandbox-exec on MacOS (ie. https://github.com/neko-kai/claude-code-sandbox) seems like the perfect solution to me. Missing FreeBSD jails in 2026 is kind of weird (hello 1999)...", "context": "", "use_case": "", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 753625376, "item_id": 47101586, "url": "https://news.ycombinator.com/item?id=47101586", "by": "Someone", "date": "2026-02-21", "version": null, "stance": "warn", "quote": "The sandbox-exec command is DEPRECATED.", "excerpt": "https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&apropos=0&sektion=1&manpath=macOS+10.13.6&format=html: \u201cThe sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide\u201d That still is the case for MacOS 26.3 (https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&apropos=0&sektion=1&manpath=macOS+26.3&format=htm", "context": "", "use_case": "Sandboxing macOS commands", "switched_from": "", "story": "macOS's Little-Known Command-Line Sandboxing Tool"}]}], "who": [{"by": "crossroadsguy", "context": "macOS user", "url": "https://news.ycombinator.com/item?id=50067105", "date": "2026-10-13"}], "tags": [], "use_cases": ["macos sandboxing", "sandboxing ai agents", "sandboxing ai coding agent", "process isolation on macos", "sandboxing macos commands", "isolating build execution"], "compared": [{"slug": "agent-safehouse", "name": "Agent Safehouse", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "nono", "name": "nono", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "bubblewrap", "name": "bubblewrap", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "codex", "name": "Codex", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=47301085", "title": "Agent Safehouse \u2013 macOS-native sandboxing for local agents", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=47101200", "title": "macOS's Little-Known Command-Line Sandboxing Tool", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=46690907", "title": "Running Claude Code dangerously (safely)", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50060694", "title": "Codex CLI installs a persistent, self-updating background daemon by default", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49985548", "title": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49402741", "title": "hdiutil is deprecated in macOS 27 Golden Gate", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {}, "2026-01": {"recommend": 2}, "2026-02": {"recommend": 2, "warn": 1}, "2026-03": {"neutral": 5}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {"neutral": 1}, "2026-09": {}, "2026-10": {"neutral": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 801073682, "item_id": 50067105, "url": "https://news.ycombinator.com/item?id=50067105", "by": "crossroadsguy", "date": "2026-10-13", "version": null, "stance": "neutral", "quote": "Right then I used sandbox-exec/safehouse (macOS) and tightened every harness installed", "excerpt": "I was delaying it but one day Codex+GLM went ahead and did things in my ~/.dotfiles folder which I had granted only READ access for. I asked and I was given a reason which I didn't understand and didn't really want to. Right then I used sandbox-exec/safehouse (macOS) and tightened every harness installed (and the one not even installed, lest I install it later and forget to add/track them in the sb zsh init script). ", "context": "macOS user", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Codex CLI installs a persistent, self-updating background daemon by default"}, {"id": 800702560, "item_id": 50043910, "url": "https://news.ycombinator.com/item?id=50043910", "by": "crossroadsguy", "date": "2026-10-11", "version": null, "stance": "neutral", "quote": "I moved to sandbox-exec (safehouse)", "excerpt": "I moved to sandbox-exec (safehouse) and now I am trying to setup a lightweight container/VM. Though of maintaining a new user but didn't seem like a great idea. How much are you paying that claude worker server?", "context": "", "use_case": "sandboxing AI coding agent", "switched_from": "", "story": "Ask HN: What do you run on a $5 VPS that's worth keeping online 24/7?"}, {"id": 790459376, "item_id": 49403711, "url": "https://news.ycombinator.com/item?id=49403711", "by": "sunshowers", "date": "2026-08-22", "version": null, "stance": "neutral", "quote": "", "excerpt": "This is only tangentially related, but libuv and mio's Windows implementations use the undocumented AFD readiness-based poll interface [1], since there isn't a documented readiness-based interface on Windows. The undocumented interface is now effectively stable since, among other reasons, Microsoft uses Tokio in some of its products. [1] https://github.com/tokio-rs/mio/blob/master/src/sys/windows/afd.rs", "context": "", "use_case": "macOS sandboxing", "switched_from": "", "story": "hdiutil is deprecated in macOS 27 Golden Gate"}, {"id": 782435538, "item_id": 48902221, "url": "https://news.ycombinator.com/item?id=48902221", "by": "kirtivr", "date": "2026-07-13", "version": null, "stance": "recommend", "quote": "OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec.", "excerpt": "On Linux, we rely on a chroot-ed workspace at this time - although we are working on a prototype using the new landlock kernel interface (https://github.com/Zouuup/landrun). OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec. For Windows, we use WSL containers when available. By default, if a safe sandbox environment is not available, we inform the user that a repro is not possible in the curren", "context": "", "use_case": "macOS sandboxing", "switched_from": "", "story": "Show HN: FixBugs \u2013 Reproduce production bugs and verify fixes"}, {"id": 760845201, "item_id": 47552825, "url": "https://news.ycombinator.com/item?id=47552825", "by": "vorticalbox", "date": "2026-03-28", "version": null, "stance": "neutral", "quote": "its a bash wrapper around sandbox-exec", "excerpt": "I\u2019m using safe house [0] its a bash wrapper around sandbox-exec 0 https://agent-safehouse.dev/", "context": "", "use_case": "", "switched_from": "", "story": "Don't YOLO your file system"}, {"id": 756894930, "item_id": 47305933, "url": "https://news.ycombinator.com/item?id=47305933", "by": "davidcann", "date": "2026-03-09", "version": null, "stance": "neutral", "quote": "UI for sandbox-exec to protect filesystem", "excerpt": "Native macOS sandbox terminal: - UI for sandbox-exec to protect filesystem - Network sandbox per domain - Secrets filter via gitleaks - Vertical tabs option It's highly customizable. You generate native macOS app wrappers for each terminal app, each with its own rules and customizations. https://multitui.com", "context": "", "use_case": "", "switched_from": "", "story": "Ask HN: What Are You Working On? (March 2026)"}, {"id": 756861393, "item_id": 47303837, "url": "https://news.ycombinator.com/item?id=47303837", "by": "siwatanejo", "date": "2026-03-08", "version": null, "stance": "neutral", "quote": "", "excerpt": "It's kinda funny that I, being skeptical about coding agents and their potential dangers, was interested to give your project a go because I don't trust AI. Yet the first thing I find in your README is that to install your tool I need to trust some random server serve me an .sh file that I will execute in my computer (not sure if with sudo... but still). Come on man, give me a tarball :) EDIT: PS: before someone give", "context": "", "use_case": "", "switched_from": "", "story": "Agent Safehouse \u2013 macOS-native sandboxing for local agents"}, {"id": 756854145, "item_id": 47303384, "url": "https://news.ycombinator.com/item?id=47303384", "by": "e1g", "date": "2026-03-08", "version": null, "stance": "neutral", "quote": "that you can feed to sandbox-exec directly", "excerpt": "Thank you for your work - I have sent many of your links to my people. Your point is totally fair for evaluating security tooling. A few notes - 1. I implemented this in Bash to avoid having an opaque binary in the way. 2. All sandbox-exec profiles are split up into individual files by specific agent/integration, and are easily auditable (https://github.com/eugene1g/agent-safehouse/tree/main/profiles) 3. There are E2", "context": "", "use_case": "", "switched_from": "", "story": "Agent Safehouse \u2013 macOS-native sandboxing for local agents"}, {"id": 756848833, "item_id": 47303052, "url": "https://news.ycombinator.com/item?id=47303052", "by": "davidcann", "date": "2026-03-08", "version": null, "stance": "neutral", "quote": "I made a native macOS app with a GUI for sandbox-exec", "excerpt": "I made a native macOS app with a GUI for sandbox-exec, plus a network sandbox with per-domain filtering and secrets detection: https://multitui.com/", "context": "", "use_case": "", "switched_from": "", "story": "Agent Safehouse \u2013 macOS-native sandboxing for local agents"}, {"id": 756830881, "item_id": 47301930, "url": "https://news.ycombinator.com/item?id=47301930", "by": "divmain", "date": "2026-03-08", "version": null, "stance": "neutral", "quote": "It is sandbox-exec, worktrees, and COW/overlay filesystem.", "excerpt": "This is what I was going for with Treebeard[0]. It is sandbox-exec, worktrees, and COW/overlay filesystem. The overlay filesystem is nice, in that you have access to git-ignored files in the original directory without having to worry about those files being modified in the original (due to the COW semantics). Though, truthfully, I haven\u2019t found myself using it much since getting it all working. [0] https://github.com", "context": "", "use_case": "", "switched_from": "", "story": "Agent Safehouse \u2013 macOS-native sandboxing for local agents"}, {"id": 753936816, "item_id": 47121051, "url": "https://news.ycombinator.com/item?id=47121051", "by": "user3939382", "date": "2026-02-23", "version": null, "stance": "recommend", "quote": "macos also has a native sandbox-exec that can be used to isolate processes with a policy you like.", "excerpt": "macos also has a native sandbox-exec that can be used to isolate processes with a policy you like. https://igorstechnoclub.com/sandbox-exec/", "context": "", "use_case": "Process isolation on macOS", "switched_from": "", "story": "Show HN: Local-First Linux MicroVMs for macOS"}, {"id": 753625376, "item_id": 47101586, "url": "https://news.ycombinator.com/item?id=47101586", "by": "Someone", "date": "2026-02-21", "version": null, "stance": "warn", "quote": "The sandbox-exec command is DEPRECATED.", "excerpt": "https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&apropos=0&sektion=1&manpath=macOS+10.13.6&format=html: \u201cThe sandbox-exec command is DEPRECATED. Developers who wish to sandbox an app should instead adopt the App Sandbox feature described in the App Sandbox Design Guide\u201d That still is the case for MacOS 26.3 (https://man.freebsd.org/cgi/man.cgi?query=sandbox-exec&apropos=0&sektion=1&manpath=macOS+26.3&format=htm", "context": "", "use_case": "Sandboxing macOS commands", "switched_from": "", "story": "macOS's Little-Known Command-Line Sandboxing Tool"}, {"id": 753625280, "item_id": 47101580, "url": "https://news.ycombinator.com/item?id=47101580", "by": "cwicklein", "date": "2026-02-21", "version": null, "stance": "recommend", "quote": "I use sandbox-exec to isolate execution", "excerpt": "I\u2019ve written a personal system in Common Lisp for building third-party software on macOS (coincidentally somewhat similar to GUIX), and I use sandbox-exec to isolate execution so that only intended requisites affect the build process and so that installation is strictly confined to the configured destination directory, no scribbling outside the lines. I think Bazel uses sandbox-exec on macOS.", "context": "", "use_case": "isolating build execution", "switched_from": "", "story": "macOS's Little-Known Command-Line Sandboxing Tool"}, {"id": 747146273, "item_id": 46696642, "url": "https://news.ycombinator.com/item?id=46696642", "by": "YaeGh8Vo", "date": "2026-01-20", "version": null, "stance": "recommend", "quote": "sandbox-exec (macOS) is probably enough and also much less overhead", "excerpt": "In my experience, a simple bubblewrap (Linux) or sandbox-exec (macOS) is probably enough and also much less overhead. LLMs agents are not exploiting kernels to get out of the sandbox. The most common issues are them trying to open PRs, or changing files where they shouldn't. - https://github.com/numtide/claudebox", "context": "", "use_case": "Sandboxing agent processes", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}, {"id": 747080369, "item_id": 46692523, "url": "https://news.ycombinator.com/item?id=46692523", "by": "woof", "date": "2026-01-20", "version": null, "stance": "recommend", "quote": "sandbox-exec on MacOS", "excerpt": "sandbox-exec on MacOS (ie. https://github.com/neko-kai/claude-code-sandbox) seems like the perfect solution to me. Missing FreeBSD jails in 2026 is kind of weird (hello 1999)...", "context": "", "use_case": "", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}, {"id": 734775136, "item_id": 45923446, "url": "https://news.ycombinator.com/item?id=45923446", "by": "viraptor", "date": "2025-11-13", "version": null, "stance": "neutral", "quote": "It's not great, but it's usable.", "excerpt": "sandbox-exec. It's not great, but it's usable. https://igorstechnoclub.com/sandbox-exec/ > It\u2019s not any different It's very different. With docker on Mac you're running a VM which runs a wrapped up complete system that runs your app. With selinux/sandbox-exec you run just your app and can skip the extra packaging needed for docker and mounts. (And get the extra performance)", "context": "", "use_case": "macOS process sandboxing", "switched_from": "", "story": "Zed is our office"}]}