overview / commands / rabadon exec
rabadon exec -- <cmd>Run <cmd> under a kernel sandbox compiled from guard.json: each protectedPaths entry becomes a read-only fence, and "network":"deny" cuts the network. A forbidden write fails with EPERM even if the hook was bypassed.
maturity: stable — shipping and tested
Backends: macOS Seatbelt (sandbox-exec), Linux bubblewrap (bwrap).
Fail-closed where it matters: if the guard asks for enforcement and no backend is available, exec refuses (exit 3) rather than run unprotected.
Related: rabadon sandbox --check (is a backend available?) and rabadon sandbox --print (emit the compiled profile, run nothing).
Exit: 0/passthrough of <cmd> · 2 nothing to run · 3 enforcement asked but no backend.
The sandbox says no backend — what do I install?