[viraptor]

sandbox-exec. It's not great, but it's usable. https://igorstechnoclub.com/sandbox-exec/

> It’s not any different

It's very different. With docker on Mac you're running a VM which runs a wrapped up complete system that runs your app.

With selinux/sandbox-exec you run just your app and can skip the extra packaging needed for docker and mounts. (And get the extra performance)

[rendaw]

Does selinux/sandbox-exec work on a Mac? Is this an apples to apples comparison?

[viraptor]

sandbox-exec is a Mac exclusive thing.

[sebmellen]

Wow TIL