Seatbelt
A sandbox security mechanism built into macOS that uses Scheme-style policy files to specify which system calls a process is permitted or forbidden to make. It constrains the permission scope of applications and is widely used for application privilege control on the macOS platform.
Core Facts
Timeline (last 90 days)
Seatbelt's policy is loaded when a process is created, after which any unauthorized operation is directly rejected by the kernel and logged, and the policy is declarative, making it easy to audit.
On macOS, srt invokes Seatbelt (the policy framework behind sandbox-exec) to restrict a process's path access and network connections.
Anthropic has open-sourced sandbox-runtime (srt), the OS-level sandbox behind Claude Code, used to constrain an agent's file and network access without requiring a container.
Seatbelt mainly constrains the routine system calls of user-space processes, and its protection against kernel vulnerabilities or certain low-level primitives is limited.
Seatbelt is the sandbox framework built into macOS, restricting a process's system calls and resource access via declarative policy files; AppContainer is a mechanism on Windows that assigns a process a low-privilege token so it can only access explicitly granted resources and capabilities.
在 macOS 上，Gemini CLI 沙箱优先使用 sandbox-exec（Seatbelt），默认 profile 为 permissive-open，允许任意文件读取，但写入仅限项目目录、临时目录、缓存、~/.npm、~/.cache 及 --include-directories 指定路径，并屏蔽 Docker socket 和对 ~/.gemini 凭证文件的写入。
Seatbelt is macOS's sandboxing framework, and bwrap (Bubblewrap) is a lightweight container tool on Linux based on user namespaces, which is used as the underlying mechanism by application sandboxes such as Flatpak
The RLM Python subprocess is an ordinary subprocess and does not go through an OS-level sandbox (Seatbelt/bwrap); that mechanism only covers shell commands
Both Claude Code and Codex use Seatbelt on macOS and Bubblewrap on Linux for process isolation.
Unsloth provides sandbox isolation for model-running code on three platforms: Bwrap on Linux, Seatbelt on macOS, and MXC on Windows.
3 more timeline events
All Facts (15)
macOS's sandbox mechanism (Seatbelt/sandbox-exec) uses SBPL (Sandbox Profile Language) to precisely define allowed file access paths and network destinations.
65%UnverifiedCodex在macOS上使用Apple的Seatbelt沙盒技术，在Linux上通过网络命名空间实现隔离
80%UnverifiedSeatbelt mainly constrains the routine system calls of user-space processes, and its protection against kernel vulnerabilities or certain low-level primitives is limited.
50%UnverifiedOn macOS, srt invokes Seatbelt (the policy framework behind sandbox-exec) to restrict a process's path access and network connections.
50%UnverifiedSeatbelt's policy is loaded when a process is created, after which any unauthorized operation is directly rejected by the kernel and logged, and the policy is declarative, making it easy to audit.
50%UnverifiedSeatbelt is the sandbox framework built into macOS, restricting a process's system calls and resource access via declarative policy files; AppContainer is a mechanism on Windows that assigns a process a low-privilege token so it can only access explicitly granted resources and capabilities.
50%Unverified在 macOS 上，Gemini CLI 沙箱优先使用 sandbox-exec（Seatbelt），默认 profile 为 permissive-open，允许任意文件读取，但写入仅限项目目录、临时目录、缓存、~/.npm、~/.cache 及 --include-directories 指定路径，并屏蔽 Docker socket 和对 ~/.gemini 凭证文件的写入。
50%UnverifiedThe RLM Python subprocess is an ordinary subprocess and does not go through an OS-level sandbox (Seatbelt/bwrap); that mechanism only covers shell commands
50%UnverifiedSeatbelt is macOS's sandboxing framework, and bwrap (Bubblewrap) is a lightweight container tool on Linux based on user namespaces, which is used as the underlying mechanism by application sandboxes such as Flatpak
50%UnverifiedBoth Claude Code and Codex use Seatbelt on macOS and Bubblewrap on Linux for process isolation.
50%UnverifiedUnsloth provides sandbox isolation for model-running code on three platforms: Bwrap on Linux, Seatbelt on macOS, and MXC on Windows.
50%UnverifiedThe runtime uses Seatbelt on macOS and Bubblewrap on Linux to achieve OS-level sandbox isolation.
50%UnverifiedSeatbelt is a sandbox mechanism built into macOS, with the underlying interface being sandbox_init, which describes the system calls a process is allowed or prohibited from making through Scheme-style policy files.
50%UnverifiedCodex uses OS-level sandboxing: Seatbelt on macOS, seccomp on Linux, and native sandbox or WSL on Windows.
50%UnverifiedAnthropic has open-sourced sandbox-runtime (srt), the OS-level sandbox behind Claude Code, used to constrain an agent's file and network access without requiring a container.
50%