Apple’s sandbox focuses on isolating the OS from non-platform binaries. It doesn’t have namespaces or cgroups. Jailbreaking on iOS is mostly about that sandbox

Apple’s sandbox focuses on isolating the OS from non-platform binaries. It doesn’t have namespaces or cgroups. Jailbreaking on iOS is mostly about that sandbox. It doesn’t relate to BSD jails. On macOS, Apple made the sandbox more lenient and implemented it a bit differently than on iOS. But both have roughly the same goals. They’re also alike in that both use the same kernel-level framework (MACF) to do their job. But the MACF is completely off-limits to everyone outside Apple. Not even accredited kext developers can use it. So I think that no one except Apple could possibly add container-style isolation to macOS.