{"id":46879043,"user":"ATechGuy","time":1770161941,"time_ago":"6 hours ago","type":"comment","content":"

Curious to know what made you DIY this?","comments":[{"id":46879081,"user":"ashishb","time":1770162053,"time_ago":"6 hours ago","type":"comment","content":"

Tell me a better alternative that allows me to run, say, 'markdown lint', an npm package, on the current directory without giving access to the full system on Mac OS?","comments":[{"id":46879176,"user":"ATechGuy","time":1770162610,"time_ago":"6 hours ago","type":"comment","content":"

sandbox-exec -f curr_dir_access_profile.sb markdownlint","comments":[{"id":46879300,"user":"ashishb","time":1770163221,"time_ago":"5 hours ago","type":"comment","content":"

So you have to install npm package markdownlint on your machine and let it run it's potentially dangerous postinstall step?","comments":[{"id":46879659,"user":"ATechGuy","time":1770165308,"time_ago":"5 hours ago","type":"comment","content":"

You can customize curr_dir_access_profile.sb to block access to network/fs/etc. Why is this not enough?","comments":[{"id":46879823,"user":"ashishb","time":1770166331,"time_ago":"5 hours ago","type":"comment","content":"

Some tools do require Internet access.

Further, I don't even want to take the risk of running 'npm install markdownlint' anymore on my machine.","comments":[{"id":46881498,"user":"ATechGuy","time":1770179652,"time_ago":"an hour ago","type":"comment","content":"

I understand the concern. However, you can customize the profile (e.g., allowlist) to only allow network access to required domains. Also, looks like your sandboxing solution is Docker based, which uses VMs on a Mac machine, but will not use VMs on a Linux machine (weak security).","comments":[{"id":46881780,"user":"ashishb","time":1770182270,"time_ago":"10 minutes ago","type":"comment","content":"

That's why I wrote my own sandbox. Everyone hand waives these concerns.

Further, I don't know why docker is weak security on Linux. Are you telling me that one can exploit docker?","comments":[],"comments_count":0,"level":6,"url":"item?id=46881780"}],"comments_count":1,"level":5,"url":"item?id=46881498"}],"comments_count":2,"level":4,"url":"item?id=46879823"}],"comments_count":3,"level":3,"url":"item?id=46879659"}],"comments_count":4,"level":2,"url":"item?id=46879300"}],"comments_count":5,"level":1,"url":"item?id=46879176"}],"comments_count":6,"level":0,"url":"item?id=46879081"}],"comments_count":7,"url":"item?id=46879043"}

Comment by ATechGuy