Apple Seatbelt
Shares rank 7 of 10 sandboxing tools by recommenders
Built-in macOS sandbox that restricts file and network access at the kernel level. Critics note it is deprecated, poorly documented and weak for containers.
Built-in macOS sandbox that restricts file and network access at the kernel level. Critics note it is deprecated, poorly documented and weak for containers.
16 people gave an opinion
- recommend it
- 9
- criticize it
- 7
- approval share
- 56%
Recommended in 5 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 9 people recommend itNeeds 10 or more, not met.
- 1.2 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Limits file access to chosen folders
“I like how these 2 sandboxes allow me to make all the file system r/o except the project folder which is r/w”
Comment from 8 Apr 2026 in “Google Open Sources Experimental Agent Orchestration Testbed Scion” “This lets you limit file and even network access fairly trivially.”
Comment from 15 Jul 2026 on Hacker News Kernel-level enforcement of restrictions
“The kernel-level approach is the right answer for protecting the host from the agent”
Comment from 23 Feb 2026 in “Kernel-enforced sandbox App and SDK for AI agents, MCP and LLM workloads” “The key design choice: Seatbelt operates at the kernel level.”
Comment from 1 Mar 2026 in “Don't trust AI agents”
What people warn about
Each mark is one comment
Deprecated and largely undocumented
“its deprecated and not maintained, Apple needs to make something new soon”
Comment from 2 Mar 2026 in “Anthropic Cowork feature creates 10GB VM bundle on macOS without warning” “seatbelt is largely undocumented.”
Comment from 2 Mar 2026 in “Anthropic Cowork feature creates 10GB VM bundle on macOS without warning” Unreliable in practice
“Claude Code (aka `claude`) uses it, and it’s barely good for anything.”
Comment from 2 Mar 2026 in “Anthropic Cowork feature creates 10GB VM bundle on macOS without warning” “This doesn't really work well in practice”
Comment from 3 Apr 2026 in “Show HN: ctx – an Agentic Development Environment (ADE)”
Other sandboxing tools people recommend
The four most recommended other sandboxing tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Bubblewrap (bwrap) | 109 | 32 | 77% | 12 | — | Approved |
| Agent Safehouse | 43 | 2 | 96% | 7 | — | Approved |
| nono | 34 | 3 | 92% | 10 | — | Approved |
| Firejail | 30 | 6 | 83% | 12 | — | Approved |
| Apple SeatbeltThis page | 9 | 7 | 56% | 5 | — | — |
What people said
16 of the 17 comments that mention it, newest first. Each links to the original comment.
“Landlock and Seatbelt reduce filesystem blast radius. They do not give you a separate kernel”
“This lets you limit file and even network access fairly trivially.”
“Seatbelt/linux sandboxing seems simpler sometimes, but has its complications too.”
“i found it consumes way more tokens when sandboxed”
“I like how these 2 sandboxes allow me to make all the file system r/o except the project folder which is r/w”
“mostly missing from the tools we have (apparmor, seccomp, oss VMs, seatbelt, docker, bubblewrap etc.)”
“This doesn't really work well in practice”
“I confirmed both bubblewrap and seatbelt to work independently”
“~2ms overhead per command, way lighter than spinning up a container every time.”
“Claude Code (aka `claude`) uses it, and it’s barely good for anything.”
“its deprecated and not maintained, Apple needs to make something new soon”
“seatbelt is largely undocumented.”
“A better sandbox environment would be Apple seatbelt, which is what OpenAI uses”
“The key design choice: Seatbelt operates at the kernel level.”
“The kernel-level approach is the right answer for protecting the host from the agent”
“pretty darn nice for gui apps, but not very good for things like containers”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.