Hi, I want something like sandbox-exec, so I can run things that I don't trust, and restrict their ability to read or write files to only certain locations. Like most software devs I have to download and run lots of code from the internet and the danger of this really annoys me. Unfortunately sandbox-exec is marked as deprecated and the APIs in sandbox.h say "No longer supported". I notice there is some new stuff in the Apple docs about "hypervisors" and "virtualization". https://developer.apple.com/documentation/hypervisor https://developer.apple.com/documentation/virtualization Would these APIs allow me to start and control a virtual copy of my macOS, to serve like a sandbox? Are there other solutions that people use? As an example, say that I need to download and run a copy of memcached. It's a typical open source project – you unpack a source tgz, then run configure; make and get a binary. Now I want to run that without worrying that some hacker injected a piece of evil code to copy my files and send them somewhere. So I want to say "run this binary, while disallowing file reads and writes, except for directories X,Y,Z, and disallowing network connections, except for listening on port 1234."

Hello! There are a few similar open-source projects that implement support for creating macOS M1 guest Virtual Machine on macOS M1 Host, for example: https://github.com/jspahrsummers/Microverse https://github.com/KhaosT/MacVM But both of them share a common problem: any audio from guest VM (system sounds or youtube videos in Safari or Firefox) is played late on host by approximately 0.3 seconds. Is there any way how we can remove this latency, so it is possible to hear real-time audio from guest VM? Regards, Eugene.

Hey there! Currently, it looks like the new Virtualization.framework APIs for virtualization macOS only work with the macOS 12.0 restore image, which doesn't seem to be available. Is there a timeline/ETA on when the macOS 12.0 restore IPSW will be available? Thanks, Michael