Educational ProjKilo: Sandboxes for AI.

Project Outcomes: Educational ProjKilo — Sandboxes for AI Project Title: Educational ProjKilo: Sandboxes for AI Time Invested: ~17 hours over 5 days (August 6–11, 2026) Scope Evolution: Expanded from an initial 0.5-day exploratory spike into an intensive 17-hour deep dive to achieve a comprehensive, rigorous understanding of macOS security, virtualization, and AI agent execution environments. Executive Summary Investigated the security posture of macOS regarding local code execution, evaluated virtualization and containerization trade-offs, and identified the practical standards for isolating autonomous AI tools. Synthesized low-level operating system mechanics with high-level developer convenience to establish ideal execution environments for untrusted or autonomous AI code. Key Technical Findings & Research Outcomes 1. macOS Application Security & Permission Models Default Privileges: Downloaded software running outside the Mac App Store executes by default with the same privileges as the host user, often without explicit warnings from the OS. Data Isolation Mechanics: Applications in the /Applications directory do not store user data directly in that directory. Instead, user data resides in designated macOS user libraries, protected natively via macOS Transparency, Consent, and Control (TCC). Interactive Permission Tools Evaluation: Audited several open-source tools designed to provide interactive permission prompts for non-App Store executables instead of failing silently. Ultimately rejected them for production use based on the following security, trust, and convenience flaws: Alcoholless: Avoided due to insufficient community validation (195 GitHub stars), which does not meet the trust threshold required for a fundamental security sandboxing tool. bx-mac: Found inadequate due to low adoption (96 stars), an insecure "allow first, block now" posture, and a reliance on static home directory snapshots, which fail to automatically block newly added files/folders. Sandvault: Dismissed due to insufficient community validation and trust (379 stars). Safehouse: Despite higher community adoption (2k stars), its strict "deny-first" architecture leads to constant, intrusive permission prompts, completely undermining developer convenience. 2. Virtualization & Container Isolation Landscape Type 1 vs. Type 2 Hypervisors: Recognized that macOS lacks a dominant, single Type 1 hypervisor for end-user desktop environments. Evaluated Type 2 / desktop virtualization standards, identifying UTM and VMware Fusion Pro as primary free, reliable options used by senior developers. Tool-Specific Constraints: Confirmed that MicroVM technologies like Firecracker cannot run directly on macOS host hardware and require a Linux VM to isolate AI tools. 3. AI Agent Execution & Developer Experience The Industry Standard: Identified Docker Sandbox as the optimal, pragmatic choice used by senior developers for running AI agents locally on macOS. Core Protections: Determined that Docker Sandbox strikes the optimal balance between developer convenience and security by providing key isolation controls: Filesystem and process isolation Network egress/ingress controls and domain allow-listing Resource usage capping (CPU/RAM) 4. OS Internals & Vocabulary Foundations Formalized core computing and system principles, including kernel vs. user-space memory boundaries, POSIX asynchronous signal handling in macOS, APFS 64-bit object mapping, and Copy-On-Write (COW) storage mechanics. Final Recommendation For running AI agents safely on macOS without risking unauthorized access to sensitive local directories, developers should utilize ephemeral execution sandboxes like Docker Sandbox as the primary environment. Full virtual machines (UTM/VMware) can supplement this when complete OS-level isolation is required.