What is Apple’s supported way to prevent outbound network access during app-hosted iOS Simulator unit tests, without disabling system services or modifying system tunnel routes? Environment: Apple silicon Mac, macOS 26.6.2 Xcode 27.0, iOS 27.0 Simulator Separate, newly created Simulator Xcode-managed local ad-hoc build 17 fictional-data tests using XCTest and Swift Testing We intend to use xcodebuild test-without-building. The test bodies exercise models and request construction without sending requests, but the app host’s startup behavior is also within our isolation requirement. Tests have not been run. During an authorized Wi-Fi-off diagnostic, we waited ten seconds and collected three samples, checking Wi-Fi power before and after each sample. All showed: Wi-Fi Off No effective network interface reported by scutil --nwi No route selected by ordinary local lookups for IPv4 and IPv6 documentation addresses Remaining interface-scoped IPv6 default entries through utun interfaces Routes selected when IPv6 lookups explicitly specified those tunnel interfaces These were routing-table queries only; no diagnostic packets were sent. Wi-Fi was restored afterward. We have not established whether the scoped routes could carry external traffic. Please advise on a supported isolation mechanism and how to validate it for the Simulator test host, including startup. We want to preserve normal macOS security/system services and avoid relying on either route-table presence or absence as proof of isolation. No real user data or credentials are needed. We can provide a redacted diagnostic summary if useful.

Supported network isolation for app-hosted iOS Simulator tests

What is Apple’s supported way to prevent outbound network access during app-hosted iOS Simulator unit tests, without disabling system services or modifying system tunnel routes?

Environment:

Apple silicon Mac, macOS 26.6.2
Xcode 27.0, iOS 27.0 Simulator
Separate, newly created Simulator
Xcode-managed local ad-hoc build
17 fictional-data tests using XCTest and Swift Testing

We intend to use xcodebuild test-without-building. The test bodies exercise models and request construction without sending requests, but the app host’s startup behavior is also within our isolation requirement. Tests have not been run.

During an authorized Wi-Fi-off diagnostic, we waited ten seconds and collected three samples, checking Wi-Fi power before and after each sample. All showed:

Wi-Fi Off
No effective network interface reported by scutil --nwi
No route selected by ordinary local lookups for IPv4 and IPv6 documentation addresses
Remaining interface-scoped IPv6 default entries through utun interfaces
Routes selected when IPv6 lookups explicitly specified those tunnel interfaces

These were routing-table queries only; no diagnostic packets were sent. Wi-Fi was restored afterward. We have not established whether the scoped routes could carry external traffic.

Please advise on a supported isolation mechanism and how to validate it for the Simulator test host, including startup. We want to preserve normal macOS security/system services and avoid relying on either route-table presence or absence as proof of isolation.

No real user data or credentials are needed. We can provide a redacted diagnostic summary if useful.