Seatbelt
A sandbox security mechanism built into macOS that uses Scheme-style policy files to specify which system calls a process is permitted or forbidden to make. It constrains the permission scope of applications and is widely used for application privilege control on the macOS platform.
Timeline (last 90 days)
Seatbelt is the sandbox framework built into macOS, restricting a process's system calls and resource access via declarative policy files; AppContainer is a mechanism on Windows that assigns a process a low-privilege token so it can only access explicitly granted resources and capabilities.
在 macOS 上，Gemini CLI 沙箱优先使用 sandbox-exec（Seatbelt），默认 profile 为 permissive-open，允许任意文件读取，但写入仅限项目目录、临时目录、缓存、~/.npm、~/.cache 及 --include-directories 指定路径，并屏蔽 Docker socket 和对 ~/.gemini 凭证文件的写入。
The RLM Python subprocess is an ordinary subprocess and does not go through an OS-level sandbox (Seatbelt/bwrap); that mechanism only covers shell commands
Seatbelt is macOS's sandboxing framework, and bwrap (Bubblewrap) is a lightweight container tool on Linux based on user namespaces, which is used as the underlying mechanism by application sandboxes such as Flatpak
Both Claude Code and Codex use Seatbelt on macOS and Bubblewrap on Linux for process isolation.
Unsloth provides sandbox isolation for model-running code on three platforms: Bwrap on Linux, Seatbelt on macOS, and MXC on Windows.
Seatbelt is a sandbox mechanism built into macOS, with the underlying interface being sandbox_init, which describes the system calls a process is allowed or prohibited from making through Scheme-style policy files.
The runtime uses Seatbelt on macOS and Bubblewrap on Linux to achieve OS-level sandbox isolation.
Codex uses OS-level sandboxing: Seatbelt on macOS, seccomp on Linux, and native sandbox or WSL on Windows.
All Facts (10)
Codex在macOS上使用Apple的Seatbelt沙盒技术，在Linux上通过网络命名空间实现隔离
80%UnverifiedSeatbelt is the sandbox framework built into macOS, restricting a process's system calls and resource access via declarative policy files; AppContainer is a mechanism on Windows that assigns a process a low-privilege token so it can only access explicitly granted resources and capabilities.
50%Unverified在 macOS 上，Gemini CLI 沙箱优先使用 sandbox-exec（Seatbelt），默认 profile 为 permissive-open，允许任意文件读取，但写入仅限项目目录、临时目录、缓存、~/.npm、~/.cache 及 --include-directories 指定路径，并屏蔽 Docker socket 和对 ~/.gemini 凭证文件的写入。
50%UnverifiedSeatbelt is macOS's sandboxing framework, and bwrap (Bubblewrap) is a lightweight container tool on Linux based on user namespaces, which is used as the underlying mechanism by application sandboxes such as Flatpak
50%UnverifiedThe RLM Python subprocess is an ordinary subprocess and does not go through an OS-level sandbox (Seatbelt/bwrap); that mechanism only covers shell commands
50%UnverifiedBoth Claude Code and Codex use Seatbelt on macOS and Bubblewrap on Linux for process isolation.
50%UnverifiedUnsloth provides sandbox isolation for model-running code on three platforms: Bwrap on Linux, Seatbelt on macOS, and MXC on Windows.
50%UnverifiedThe runtime uses Seatbelt on macOS and Bubblewrap on Linux to achieve OS-level sandbox isolation.
50%UnverifiedSeatbelt is a sandbox mechanism built into macOS, with the underlying interface being sandbox_init, which describes the system calls a process is allowed or prohibited from making through Scheme-style policy files.
50%UnverifiedCodex uses OS-level sandboxing: Seatbelt on macOS, seccomp on Linux, and native sandbox or WSL on Windows.
50%