oms doctor reports which one is active.
macOS: Seatbelt
Each command runs assandbox-exec -f <profile> <argv>. The profile starts with (allow default) and then narrows it. It governs file reads, file writes and network, plus a keychain lookup. Seatbelt is not a virtual machine.
Reads. Reading under your home folder is denied. Then OMS reopens the worktree and toolchain roots: node, ~/.cargo, ~/.rustup, ~/.local/share/solana, ~/.avm, ~/.nvm, ~/.volta, ~/.bun, ~/.fnm, each PATH entry, git directories of a linked worktree, read-only mounts and the Surfpool binary. After that it denies again: files matching -keypair.json or /id.json, and these folders under home: .ssh, .config/solana, .aws, Library, .config/gh, .docker, .netrc and .npmrc. The keychain services com.apple.SecurityServer and com.apple.securityd are denied. Reads outside home, such as /etc and /usr, are not denied.
Writes. All writes are denied, then OMS allows the worktree, the run’s private HOME, temp folders, read-write mounts and Cargo’s download caches. Writes to pinned verifier files and the task’s .git are denied again.
Network. All network is denied, then OMS allows outbound to the local Surfnet port only. When OMS passes its trusted Surfpool binary, which it does in a host session, it also allows loopback listening and outbound to localhost:8899, 8900 and 9900, the standard JSON-RPC, websocket and faucet ports. No non-loopback destination is allowed.
Environment. Commands start from an empty environment plus an allowlist: PATH, HOME, CARGO_HOME, RUSTUP_HOME, LANG, LC_ALL, LC_CTYPE, LC_MESSAGES, TMPDIR, SHELL, TERM, SOLANA_RPC_URL, SURFNET_RPC_URL and OMS_OUTPUT_DIR. HOME is a private per-run folder removed afterwards, and API keys and AWS_* never reach commands.
Tests. Yes for the profile structure, rule order, quoting, the environment scrub and doctor reporting. Yes for real enforcement on a Mac of these blocks: keypair reads, ~/.ssh, ~/.config/solana, other-repo reads, writes outside the worktree, writes to a pinned verifier file, the keychain, and network other than the Surfnet port.
Not covered. ~/.aws, ~/Library (apart from the keychain service), ~/.config/gh, ~/.docker, ~/.netrc and ~/.npmrc have no real-enforcement test. They are checked only as text in the profile.
Linux: no sandbox
On Linux, host mode has no operating system sandbox, so network access is unrestricted and an approved command can read anything your user can. The same applies on macOS whensandbox-exec is missing.
Some protections still apply: the scrubbed environment, a private per-run HOME, approval for every model shell command, and the file guards. OMS prints a one-time warning per state folder: “OMS host mode has NO sandbox here”. /settings shows “No sandbox. Commands need approval; network is unrestricted.” and oms doctor reports “host (no sandbox; unrestricted network)”.
Tests: yes for the environment, HOME and approval. No test covers the one-time warning text.
Docker mode
If you want confinement on Linux, use Docker mode. It uses an immutable pinned image from the runtime manifest and never pulls at run time. The container flags include--pull=never, --read-only, capability drop, a security option, a non-root user, --tmpfs, limits on processes, memory and CPUs, and an explicit --network choice.
Tests: yes for the arguments. No privileged mode, no docker.sock mount, no host network. Real daemon runs are covered only by integration tests that need Docker. Those results were not run for this documentation.