sandbox-exec
Hacker ApprovedRanked 5 of 10 sandboxing tools by recommenders
Free macOS built-in tool that people use to restrict what wrapped commands and coding agents can read and reach; it is hard to configure and poorly documented.
Free macOS built-in tool that people use to restrict what wrapped commands and coding agents can read and reach; it is hard to configure and poorly documented.
32 people gave an opinion
- recommend it
- 25
- criticize it
- 7
- approval share
- 78%
Recommended in 11 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 25 people recommend itNeeds 10 or more, met.
- 3.6 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 11 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Wraps AI coding agents safely
“I would feed better with a more rigid safety net, which is why I've been explicitly invoking claude with sandbox-exec.”
Comment from 21 Feb 2026 in “macOS's Little-Known Command-Line Sandboxing Tool” “If you are on macOS it is not a bad idea to use sandbox-exec to wrap your claude or other coding agents around.”
Comment from 15 Dec 2025 in “Claude CLI deleted my home directory and wiped my Mac” “I run it on Mac with sandbox-exec. No access to AWS, database, pretty much just files in the current folder.”
Comment from 17 Jul 2026 in “Claude Code: Anatomy of a Misfeature” - Comment from 18 Sep 2026 in “Inside ZCode: Silently uploading your Git history to the cloud”
- Comment from 2 Sep 2026 in “Claude Fable 5.1 and Claude Mythos 5.1”
Built into macOS, no install
“I trust sandbox-exec more, or Docker on Linux. Those come from the OS, well tested and known.”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” “But it’s available everywhere, and still works - and protects us - like brand new!”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec.”
Comment from 14 Jul 2026 in “Show HN: FixBugs – Reproduce production bugs and verify fixes” - Comment from 31 Mar 2026 on Hacker News
Lightweight with little overhead
“a simple bubblewrap (Linux) or sandbox-exec (macOS) is probably enough and also much less overhead”
Comment from 20 Jan 2026 in “Running Claude Code dangerously (safely)” “bubblewrap and similar (Landlock, sandbox-exec on Mac) are solid lightweight options”
Comment from 30 Jan 2026 in “Show HN: Amla Sandbox – WASM bash shell sandbox for AI agents” “There's no reason to bring a whole new system along just to restrict some access.”
Comment from 14 Nov 2025 in “Zed is our office” - Comment from 20 Aug 2026 in “Malicious Rust Crate Arrayref Runs a Build-Time Payload”
Restricts file and network access
“I run it on Mac with sandbox-exec. No access to AWS, database, pretty much just files in the current folder.”
Comment from 17 Jul 2026 in “Claude Code: Anatomy of a Misfeature” “the sandbox-exec tool still works perfectly to avoid that kind of horror story”
Comment from 1 Dec 2025 in “Google Antigravity just deleted the contents of whole drive” “Sandbox-exec covers everything I personally expect from a sandbox”
Comment from 21 Feb 2026 in “macOS's Little-Known Command-Line Sandboxing Tool”
What people warn about
Each mark is one comment
Poorly documented, hard to learn
“I'd love to have Claude write me proper documentation for the sandbox-exec command for example, but that thing is pretty much a black hole”
Comment from 11 Jan 2026 in “Don't fall into the anti-AI hype” “Most sandboxes - including sandbox-exec itself - are massively under-documented.”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “Apple's sandbox-exec which is itself almost entirely undocumented”
Comment from 1 Apr 2026 in “Show HN: Zerobox – Sandbox any command with file and network restrictions” - Comment from 21 Feb 2026 in “macOS's Little-Known Command-Line Sandboxing Tool”
Profiles hard to configure correctly
“using sandbox-exec has yielded better workflows (if & when I've gotten an appropriate profile stood up)”
Comment from 20 Jul 2026 in “Stop Using OpenCode” “It is a pain to configure properly but at least I know where sandbox is controlled.”
Comment from 29 Dec 2025 in “Karpathy on Programming” “It is also easy to get wrong if there is not a "(default deny)" in the profile.”
Comment from 21 Feb 2026 in “macOS's Little-Known Command-Line Sandboxing Tool” - Comment from 21 Feb 2026 in “macOS's Little-Known Command-Line Sandboxing Tool”
Apple has deprecated it
“It's also poorly documented and IIRC deprecated.”
Comment from 21 Feb 2026 in “macOS's Little-Known Command-Line Sandboxing Tool” “There is a reason why it is deprecated by Apple.”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” Has been bypassed before
“it has been bypassed before and having it being used all over the OS doesn't mean anything”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “All the sandbox-exec and all the Lulu rules are not going to protect against something like this.”
Comment from 21 Oct 2026 in “Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor”
Other sandboxing tools people recommend
The four most recommended other sandboxing tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bubblewrap (bwrap) | 109 | 32 | 77% | 12 | — | Approved |
| Agent Safehouse | 43 | 2 | 96% | 7 | — | Approved |
| nono | 34 | 3 | 92% | 10 | — | Approved |
| Firejail | 30 | 6 | 83% | 12 | — | Approved |
| sandbox-execThis page | 25 | 7 | 78% | 11 | — | Approved |
What people said
38 of the 43 comments that mention it, newest first. Each links to the original comment.
“All the sandbox-exec and all the Lulu rules are not going to protect against something like this.”
“wrapping the harness around something like sandbox-exec or agent-safehouse is a must”
“Hacked together something with omp and sandbox-exec”
“Or sandbox-execute. There's no performance overhead. Complexity is minimal.”
“most tools based on bubblewrap/sandbox-exec”
“using sandbox-exec has yielded better workflows (if & when I've gotten an appropriate profile stood up)”
“A proper sandbox has full context of the execution chain.”
“I run it on Mac with sandbox-exec. No access to AWS, database, pretty much just files in the current folder.”
“OSX is the best, we use the in-built (seatbelt) sandbox via sandbox-exec.”
“Important is to isolate tasks from each other.”
“I trust sandbox-exec more, or Docker on Linux. Those come from the OS, well tested and known.”
“Apple's sandbox-exec which is itself almost entirely undocumented”
“I like macOS native sandbox-exec”
“Manually wrapping it in sandbox-exec solved the issue.”
“it has been bypassed before and having it being used all over the OS doesn't mean anything”
“There is a reason why it is deprecated by Apple.”
“But it’s available everywhere, and still works - and protects us - like brand new!”
“Most sandboxes - including sandbox-exec itself - are massively under-documented.”
“we're continuing to find great uses for it”
“You're better off just making a copy of the tree and simply using sandbox-exec.”
“It is also easy to get wrong if there is not a "(default deny)" in the profile.”
“without fighting SBPL quirks or mysterious denials”
“There are a lot of gems like Sandboxing and Hyperkit with incredible features”
“Sandbox-exec covers everything I personally expect from a sandbox”
“no longer going to deprecate sandbox-exec and instead publish detailed documentation for it”
“I would feed better with a more rigid safety net, which is why I've been explicitly invoking claude with sandbox-exec.”
“The tool is useful, but the feedback loop is rough.”
“It's also poorly documented and IIRC deprecated.”
“bubblewrap and similar (Landlock, sandbox-exec on Mac) are solid lightweight options”
“a simple bubblewrap (Linux) or sandbox-exec (macOS) is probably enough and also much less overhead”
“seems like the perfect solution to me”
“sandbox-exec as a mac alternative”
“I'd love to have Claude write me proper documentation for the sandbox-exec command for example, but that thing is pretty much a black hole”
“It is a pain to configure properly but at least I know where sandbox is controlled.”
“If you are on macOS it is not a bad idea to use sandbox-exec to wrap your claude or other coding agents around.”
“the sandbox-exec tool still works perfectly to avoid that kind of horror story”
“It's not great, but it's usable.”
“There's no reason to bring a whole new system along just to restrict some access.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.