A thread you can test
Sandbox
5 notes move from the word to a real choice at work — understand it first, then decide whether to use it.
Each note stands alone, or becomes the next step in this thread.
THE QUESTION THIS PAGE ANSWERS
ANSWER FIRSTWhat is Sandbox, and which AI decisions does it change?
What shell the same command gets on three platforms. Wanting a sandbox and having a backend are two different questions This page keeps the related concepts, common mistakes, and practical notes in one reading thread.
First decide whether you are blocked by a definition, a choice, or verification; then choose the closest of the 5 notes below.
Start with “Sandbox manager: compile a permission profile into one command,” then restate the conclusion using your own task.
Do not treat every method in a topic as interchangeable. The answer changes with the input, risk, and acceptance bar.
THIS QUESTION THREAD
Put the word back inside the choice it changes.
Sandbox manager: compile a permission profile into one command
What shell the same command gets on three platforms. Wanting a sandbox and having a backend are two different questions
macOS: stitch a security policy into one string
On macOS, Seatbelt’s policy is stitched from text fragments. Paths go in a param table; a carve-out must block the node, its descendants, and a move
Linux: build the view, then seccomp, then exec
On Linux, Codex first swaps the filesystem view with bubblewrap, then applies seccomp in the same helper, and only then execs the user command. Send one access request through and see which layer stops it
Windows: restricted token, firewall filter, and two dedicated system users
Windows has no seatbelt and no bubblewrap. Codex stacks a restricted token, a firewall filter, and two dedicated system users into a sandbox — and why AppContainer does not fit this permission model
execpolicy: Let the Policy File Carry Its Own Tests
Codex writes positive and negative examples into the rule itself: how a command is split, prefix-matched, and judged at the strictest level, and how load-time tests pin down false hits