---
title: "Sandbox"
description: "macOS Seatbelt, Docker mode, and what Linux host mode does not have."
url: https://barestate.xyz/docs/security/sandbox
---

# Sandbox

> macOS Seatbelt, Docker mode, and what Linux host mode does not have.

The file guards only see what the model asks for. The sandbox is what limits what a command can actually do once it runs. This page tells you which confinement you get on your platform, what each one blocks, and what has and hasn't been tested.

Host mode is the default. It runs commands on your machine in the task worktree. Docker mode is the alternative.

| Platform and mode | Operating system confinement |
|---|---|
| macOS, host mode | Seatbelt, when `/usr/bin/sandbox-exec` exists |
| macOS without `sandbox-exec` | None |
| Linux, host mode | None |
| Docker mode (`--sandbox docker` or `OMS_SANDBOX=docker`) | Container |

`oms doctor` reports which one is active.

## macOS: Seatbelt

Each command runs as `sandbox-exec -f <profile> <argv>`. The profile starts with `(allow default)` and then narrows it. It governs file reads, file writes and network, plus a keychain lookup. Seatbelt is not a virtual machine.

**Reads.** Reading under your home folder is denied. Then OMS reopens the worktree and toolchain roots: node, `~/.cargo`, `~/.rustup`, `~/.local/share/solana`, `~/.avm`, `~/.nvm`, `~/.volta`, `~/.bun`, `~/.fnm`, each `PATH` entry, git directories of a linked worktree, read-only mounts and the Surfpool binary. After that it denies again: files matching `-keypair.json` or `/id.json`, and these folders under home: `.ssh`, `.config/solana`, `.aws`, `Library`, `.config/gh`, `.docker`, `.netrc` and `.npmrc`. The keychain services `com.apple.SecurityServer` and `com.apple.securityd` are denied. Reads outside home, such as `/etc` and `/usr`, are not denied.

**Writes.** All writes are denied, then OMS allows the worktree, the run's private HOME, temp folders, read-write mounts and Cargo's download caches. Writes to pinned verifier files and the task's `.git` are denied again.

**Network.** All network is denied, then OMS allows outbound to the local Surfnet port only. When OMS passes its trusted Surfpool binary, which it does in a host session, it also allows loopback listening and outbound to `localhost:8899`, `8900` and `9900`, the standard JSON-RPC, websocket and faucet ports. No non-loopback destination is allowed.

**Environment.** Commands start from an empty environment plus an allowlist: `PATH`, `HOME`, `CARGO_HOME`, `RUSTUP_HOME`, `LANG`, `LC_ALL`, `LC_CTYPE`, `LC_MESSAGES`, `TMPDIR`, `SHELL`, `TERM`, `SOLANA_RPC_URL`, `SURFNET_RPC_URL` and `OMS_OUTPUT_DIR`. HOME is a private per-run folder removed afterwards, and API keys and `AWS_*` never reach commands.

**Tests.** Yes for the profile structure, rule order, quoting, the environment scrub and doctor reporting. Yes for real enforcement on a Mac of these blocks: keypair reads, `~/.ssh`, `~/.config/solana`, other-repo reads, writes outside the worktree, writes to a pinned verifier file, the keychain, and network other than the Surfnet port.

**Not covered.** `~/.aws`, `~/Library` (apart from the keychain service), `~/.config/gh`, `~/.docker`, `~/.netrc` and `~/.npmrc` have no real-enforcement test. They are checked only as text in the profile.

## Linux: no sandbox

On Linux, host mode has no operating system sandbox, so network access is unrestricted and an approved command can read anything your user can. The same applies on macOS when `sandbox-exec` is missing.

Some protections still apply: the scrubbed environment, a private per-run HOME, approval for every model shell command, and the file guards. OMS prints a one-time warning per state folder: "OMS host mode has NO sandbox here". `/settings` shows "No sandbox. Commands need approval; network is unrestricted." and `oms doctor` reports "host (no sandbox; unrestricted network)".

Tests: yes for the environment, HOME and approval. No test covers the one-time warning text.

## Docker mode

If you want confinement on Linux, use Docker mode. It uses an immutable pinned image from the runtime manifest and never pulls at run time. The container flags include `--pull=never`, `--read-only`, capability drop, a security option, a non-root user, `--tmpfs`, limits on processes, memory and CPUs, and an explicit `--network` choice.

Tests: yes for the arguments. No privileged mode, no `docker.sock` mount, no host network. Real daemon runs are covered only by integration tests that need Docker. Those results were not run for this documentation.

## The verifier's own isolation

The pinned check runs against a fresh offline Surfpool. The Surfnet port is the only reachable host port, and the check runs against saved inputs, not your live worktree. On Linux host mode there is no network confinement, so that guarantee holds only under Seatbelt or Docker. No test covers Linux enforcement.