3 ms·
There is an equivalent. I played with it for a while before switching to containers. You can just sign an app with sandbox entitlements that starts a subshell a
by mike_hearn 1y ago
There is an equivalent. I played with it for a while before switching to containers. You can just sign an app with sandbox entitlements that starts a subshell and uses security bookmarks to expose folders to it. It's all fully supported by Apple.
- simonw 1y agoI would love to be able to use sandbox entitlements for this. I have so far been unable to figure out how.
- mike_hearn 1y agoWhat issues did you hit? The main issue I had is that most dev tools aren't sandbox compatible out of the box and it's Apple specific tech. You can add SBPL exceptions to make more stuff work but why bother. Containers/Linux VMs work everywhere.
- xyzzy_plugh 1y agoIt's not equivalent. You can restrict access but expose select resources, but there's no bind mounting, no overlays, etc. etc. It's a very far cry from bwrap.
- mike_hearn 1y agoYou don't need bind mounts, you can just pass access rights to directories into the sandbox directly. Also sandboxed apps run inside a (filesystem) container so file writes to $HOME are transparently redirected to a shadow home.
- xyzzy_plugh 1y agoRespectfully, it's not enough. You can't treat the inside of the sandbox as a generic macOS system. You can't really install arbitrary things or run arbitrary programs. The wheels fall off extremely quickly.
- mike_hearn 1y agoThat's true which is why I abandoned that approach, but the original comparison was against Bubblewrap which has the same issues (yes with enough overlays you can make a semi-writable system into which you can install things but you can tunnel brew outside the sandbox also).
- xyzzy_plugh 1y agoBubblewrap does not really have these issues at all. It's pretty much full containerization.