sandbox-exec was deprecated on MacOS few years ago

Resolved 💬 3 comments Opened Apr 17, 2025 by arekt Closed Apr 17, 2025

💡 Likely answer: A maintainer (tibo-openai, collaborator) responded on this thread — see the highlighted reply below.

https://github.com/openai/codex/blob/b0ccca555685b1534a0028cb7bfdcad8fe2e477a/codex-cli/src/utils/agent/sandbox/macos-seatbelt.ts#L61

quick check on MacOS 15.4

# man sandbox-exec 

SANDBOX-EXEC(1)                              General Commands Manual                             SANDBOX-EXEC(1)

NAME
     sandbox-exec – execute within a sandbox (DEPRECATED)

SYNOPSIS
     sandbox-exec [-f profile-file] [-n profile-name] [-p profile-string] [-D key=value ...] command
                  [arguments ...]

View original on GitHub ↗

3 Comments

tibo-openai collaborator · 1 year ago

Ack, it still works very well and allows us to get started for now. Would love to see a proposal on implementing sandboxing across different platforms and discuss there!

AkihiroSuda · 1 year ago

Would love to see a proposal on implementing sandboxing across different platforms and discuss there!

I'm proposing an API for sandboxing shell commands and file I/O, with an arbitrary backend such as https://github.com/AkihiroSuda/alcless (Incorporates su, sudo, and rsync on macOS to execute a command as another user, with a copy of the current directory) .

I opened an issue in Gemini's repo, however, I believe this proposal should be useful for codex too, and I'm hoping that there can be a chance of standardizing the protocol for sandboxing 🙏

https://github.com/google-gemini/gemini-cli/issues/3216

ashishb · 5 months ago

Consider Amazing Sandbox as well; it uses Docker-based isolation, good developer experience, is cross-platform, and does not use anything that's deprecated.