{"slug": "sandvault", "name": "sandvault", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 3, "commenters": 4, "warners": 0, "score": 2.886, "rising": -0.98, "first": "2026-01-26", "latest": "2026-07-08", "why": "This is the solution I chose for sandvault [0], which works well on my Mac", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 1, "compare": 1, "warn": 0}, "spark": [0, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "This is the solution I chose for sandvault [0], which works well on my Mac", "kind": "", "icon": false, "domain": null, "github_repo": "github.com/webcoyote/sandvault", "official_url": "https://github.com/webcoyote/sandvault", "pricing": "", "aliases": ["sandvault", "SandVault", "Sandvault"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 781356320, "item_id": 48834770, "url": "https://news.ycombinator.com/item?id=48834770", "by": "mikemcquaid", "date": "2026-07-08", "stance": "recommend", "quote": "sandvault is good for this and does auto install", "excerpt": "Sandbox and separate user instead of VM but sandvault is good for this and does auto install (full disclosure: have made some PRs to it). https://github.com/webcoyote/sandvault", "context": "", "use_case": "Sandbox for AI agents", "switched_from": "", "story": "Show HN: Davit, a Apple Containers UI"}, {"id": 756836336, "item_id": 47302271, "url": "https://news.ycombinator.com/item?id=47302271", "by": "pash", "date": "2026-03-08", "stance": "recommend", "quote": "is another approach based on sandbox-exe, but that additionally uses the good old Unix user system", "excerpt": "Sandvault [0] (whose author is around here somewhere), is another approach based on sandbox-exe, but that additionally uses the good old Unix user system for further isolation. Basically, give an agent its own unprivileged user account (interacting with it via sudo, SSH, and shared directories), then add sandbox-exe on top for resource-specific permissions and another layer of isolation. 0. https://github.com/webcoyo", "context": "", "use_case": "", "switched_from": "", "story": "Agent Safehouse \u2013 macOS-native sandboxing for local agents"}, {"id": 748358416, "item_id": 46772401, "url": "https://news.ycombinator.com/item?id=46772401", "by": "realityfactchex", "date": "2026-01-26", "stance": "recommend", "quote": "Actually seems like a great idea IMO", "excerpt": "> user permissions/groups never come into the sandboxing discussions Sometimes *nix user accounts for AI agent sandboxing does come up in discussions. At [0], HN user netcoyote linked to his sandvault tool [1], which \"sandboxes AI agents in a MacOS limited user account\". Actually seems like a great idea IMO, to be lightweight, generic, and robust-enough. [0] https://news.ycombinator.com/item?id=46760777 [1] https://g", "context": "", "use_case": "sandboxing AI agents on macOS", "switched_from": "", "story": "The Browser Is the Sandbox"}, {"id": 747082848, "item_id": 46692678, "url": "https://news.ycombinator.com/item?id=46692678", "by": "netcoyote", "date": "2026-01-20", "stance": "recommend", "quote": "This is the solution I chose for sandvault [0], which works well on my Mac", "excerpt": "This is the solution I chose for sandvault [0], which works well on my Mac since agents can run OSX-specific tools. It just got added to Homebrew: brew install sandvault Or clodpod [1] for a VM-based solution 0: https://github.com/webcoyote/sandvault 1: https://github.com/webcoyote/clodpod", "context": "", "use_case": "sandboxing agents on macOS", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["sandbox for ai agents", "sandboxing ai agents", "sandboxing ai agents on macos", "sandboxing agents on macos"], "compared": [], "makers": [{"id": 775298944, "item_id": 48456184, "url": "https://news.ycombinator.com/item?id=48456184", "by": "netcoyote", "date": "2026-06-08", "stance": "recommend", "quote": "runs agents in a separate macOS user account, hardened with sandbox-exec", "excerpt": "Tools I\u2019ve built for myself: - sandvault https://www.codeofhonor.com/projects/sandvault/ runs agents in a separate macOS user account, hardened with sandbox-exec. It also supports headless browsing and iOS Simulator from inside the sandbox for testing web and iOS apps. - clodpod https://www.codeofhonor.com/projects/clodpod/ agents run inside a macOS VM. - git-multi-hook https://www.codeofhonor.com/projects/git-multi-", "context": "", "use_case": "sandboxing agents on macOS", "switched_from": "", "story": "Ask HN: What are tools you have made for yourself since the advent of AI"}, {"id": 764065520, "item_id": 47754095, "url": "https://news.ycombinator.com/item?id=47754095", "by": "netcoyote", "date": "2026-04-13", "stance": "recommend", "quote": "I added browser automation capabilities to sandvault", "excerpt": "I added browser automation capabilities to sandvault [0], a MacOS sandbox, to allow AI agents to control Chrome browser from within the sandbox, which makes coding & testing websites from within the sandbox much easier. I'm using sandvault+Claude to rebuild my personal blog, Code of Honor [1], because I got tired of WordPress. The site includes search functionality, and articles are automatically syndicated to Mastad", "context": "", "use_case": "sandbox for AI agents", "switched_from": "", "story": "Ask HN: What Are You Working On? (April 2026)"}, {"id": 757557296, "item_id": 47347331, "url": "https://news.ycombinator.com/item?id=47347331", "by": "netcoyote", "date": "2026-03-11", "stance": "recommend", "quote": "There are now enough AI sandboxing projects (including mine: sandvault and clodpod)", "excerpt": "As binwiederhier mentioned, we're all solving the same problems in different ways. There are now enough AI sandboxing projects (including mine: sandvault and clodpod) that I started a list: https://github.com/webcoyote/awesome-AI-sandbox", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: A context-aware permission guard for Claude Code"}, {"id": 748172432, "item_id": 46760777, "url": "https://news.ycombinator.com/item?id=46760777", "by": "netcoyote", "date": "2026-01-25", "stance": "recommend", "quote": "sandboxes AI agents in a MacOS limited user account", "excerpt": "- https://github.com/webcoyote/sandvault: sandboxes AI agents in a MacOS limited user account, and also uses sandbox-exec to limit access, though fence has more strict limitations - https://github.com/webcoyote/clodpod: sandboxes AI agents in a MacOS virtual machine Note: I\u2019m the author of both of these Apache open-source projects", "context": "", "use_case": "sandboxing AI agents on macOS", "switched_from": "", "story": "Show HN: Fence \u2013 Sandbox CLI commands with network/filesystem restrictions"}, {"id": 746284400, "item_id": 46642775, "url": "https://news.ycombinator.com/item?id=46642775", "by": "netcoyote", "date": "2026-01-15", "stance": "recommend", "quote": "Run AI agents isolated in a sandboxed macOS user account", "excerpt": "Here are my open-source (MIT) solutions for Mac development: SandVault [0]: Run AI agents isolated in a sandboxed macOS user account ClodPod [1]: Run AI agents isolated inside an OSX virtual machine 0: https://github.com/webcoyote/sandvault 1: https://github.com/webcoyote/clodpod", "context": "", "use_case": "Sandboxing AI agents on macOS", "switched_from": "", "story": "Claude Cowork Runs Linux VM via Apple Virtualization Framework"}, {"id": 742402416, "item_id": 46400151, "url": "https://news.ycombinator.com/item?id=46400151", "by": "netcoyote", "date": "2025-12-27", "stance": "recommend", "quote": "I find that I use the low-privilege account solution more because it's easier to setup and doesn't require the overhead of a full VM", "excerpt": "I use a Mac, and wanted to be able to run MacOS programs like Xcode and iOS simulator, so I wrote a couple of different sandbox projects: - SandVault (https://github.com/webcoyote/sandvault) runs the AI agent in a low-privilege account - ClodPod (https://github.com/webcoyote/clodpod) runs the AI agent inside a MacOS VM In both cases I map my code directories using shares/mounts. I find that I use the low-privilege ac", "context": "Mac user running Xcode and iOS simulator", "use_case": "sandboxing AI agents on Mac", "switched_from": "", "story": "Ask HN: How are you sandboxing coding agents?"}], "threads": [{"url": "https://news.ycombinator.com/item?id=47184049", "title": "Let's Discuss Sandbox Isolation", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=48821848", "title": "Show HN: Davit, a Apple Containers UI", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48449187", "title": "Ask HN: What are tools you have made for yourself since the advent of AI", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47741527", "title": "Ask HN: What Are You Working On? (April 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47343927", "title": "Show HN: A context-aware permission guard for Claude Code", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47301085", "title": "Agent Safehouse \u2013 macOS-native sandboxing for local agents", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {"compare": 1, "neutral": 1}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 781356320, "item_id": 48834770, "url": "https://news.ycombinator.com/item?id=48834770", "by": "mikemcquaid", "date": "2026-07-08", "stance": "recommend", "quote": "sandvault is good for this and does auto install", "excerpt": "Sandbox and separate user instead of VM but sandvault is good for this and does auto install (full disclosure: have made some PRs to it). https://github.com/webcoyote/sandvault", "context": "", "use_case": "Sandbox for AI agents", "switched_from": "", "story": "Show HN: Davit, a Apple Containers UI"}, {"id": 756836336, "item_id": 47302271, "url": "https://news.ycombinator.com/item?id=47302271", "by": "pash", "date": "2026-03-08", "stance": "recommend", "quote": "is another approach based on sandbox-exe, but that additionally uses the good old Unix user system", "excerpt": "Sandvault [0] (whose author is around here somewhere), is another approach based on sandbox-exe, but that additionally uses the good old Unix user system for further isolation. Basically, give an agent its own unprivileged user account (interacting with it via sudo, SSH, and shared directories), then add sandbox-exe on top for resource-specific permissions and another layer of isolation. 0. https://github.com/webcoyo", "context": "", "use_case": "", "switched_from": "", "story": "Agent Safehouse \u2013 macOS-native sandboxing for local agents"}, {"id": 755018432, "item_id": 47188652, "url": "https://news.ycombinator.com/item?id=47188652", "by": "davidcann", "date": "2026-02-27", "stance": "neutral", "quote": "", "excerpt": "My app is a macOS terminal wrapper with nice GUI for sandbox-exec and network sandbox. I just added a vertical tabs option too. https://multitui.com", "context": "", "use_case": "", "switched_from": "", "story": "Let's Discuss Sandbox Isolation"}, {"id": 754964000, "item_id": 47185250, "url": "https://news.ycombinator.com/item?id=47185250", "by": "pash", "date": "2026-02-27", "stance": "compare", "quote": "One interesting approach that I\u2019m about to try is Sandvault [0] (macOS only)", "excerpt": "OK, let\u2019s survey how everybody is sandboxing their AI coding agents in early 2026. What I\u2019ve seen suggests the most common answers are either (a) \u201ccontainers\u201d, or (b) \u201cYOLO!\u201d (maybe adding, \u201cPlease play nice, agent.\u201d). One interesting approach that I\u2019m about to try is Sandvault [0] (macOS only), which uses the good old Unix user system together with some added precautions. Basically, give an agent its own unprivilege", "context": "", "use_case": "Sandboxing AI agents", "switched_from": "", "story": "Let's Discuss Sandbox Isolation"}, {"id": 748358416, "item_id": 46772401, "url": "https://news.ycombinator.com/item?id=46772401", "by": "realityfactchex", "date": "2026-01-26", "stance": "recommend", "quote": "Actually seems like a great idea IMO", "excerpt": "> user permissions/groups never come into the sandboxing discussions Sometimes *nix user accounts for AI agent sandboxing does come up in discussions. At [0], HN user netcoyote linked to his sandvault tool [1], which \"sandboxes AI agents in a MacOS limited user account\". Actually seems like a great idea IMO, to be lightweight, generic, and robust-enough. [0] https://news.ycombinator.com/item?id=46760777 [1] https://g", "context": "", "use_case": "sandboxing AI agents on macOS", "switched_from": "", "story": "The Browser Is the Sandbox"}, {"id": 747082848, "item_id": 46692678, "url": "https://news.ycombinator.com/item?id=46692678", "by": "netcoyote", "date": "2026-01-20", "stance": "recommend", "quote": "This is the solution I chose for sandvault [0], which works well on my Mac", "excerpt": "This is the solution I chose for sandvault [0], which works well on my Mac since agents can run OSX-specific tools. It just got added to Homebrew: brew install sandvault Or clodpod [1] for a VM-based solution 0: https://github.com/webcoyote/sandvault 1: https://github.com/webcoyote/clodpod", "context": "", "use_case": "sandboxing agents on macOS", "switched_from": "", "story": "Running Claude Code dangerously (safely)"}]}