Sandbox

Secure Sandbox (beta)

Requires macOS 14 or later on Apple Silicon or Intel. Choose the regular DMG for Apple Silicon or the Intel DMG (-intel.dmg) for Intel. Secure Sandbox requires Apple Silicon and macOS 26 or later. Liquid Glass and Control Center require macOS 26; macOS 14/15 use standard controls. Apple Intelligence domain suggestions require macOS 26 and an available on-device model; Spotlight server indexing requires macOS 15.

The Secure Sandbox runs apps in mini VMs, each with its own server. Every app opens as its own Mac app, with its own window and Dock icon, and nothing it does can reach the internet except through the server you pick for its mini VM. If that server stops working, the app is cut off; it never falls back to your normal connection.

Nothing is downloaded until you open the sandbox for the first time.

Getting it

1. Click Sandbox in the main window's toolbar or in the menu bar panel.
2. The first time, a sheet shows the download size and how much memory the sandbox may use. Click Download, or Not Now.
3. When the download is checked and installed, click Open Sandbox. From then on, Sandbox opens the Sandbox window directly.

The download goes through V2Mac's connection when you are connected. V2Mac installs only a sandbox release signed by the project, so a changed download is refused.

The Sandbox window

The sidebar lists your mini VMs with their exit status. The toolbar has:

• Start / Stop: start or stop the sandbox. It also starts by itself when you open a sandbox app, and stops 5 minutes after the last one closes.
• New Mini VM (+):
  • Empty Mini VM: a new mini VM with no apps.
  • From a Template: a mini VM with a ready set of apps from the store.
  • Clone with Apps and Data: a copy of an existing mini VM.

Select a mini VM to see its settings.

Network: the Server its traffic goes through, and its Exit:

• green: the place its traffic leaves from, for example "Frankfurt";
• red Not connected: the server stopped working. Apps in it are cut off, and you get one notification. Pick another server; V2Mac never switches on its own;
• No exit (blocked): the mini VM has no internet at all.

When you change the server, or pick No exit (blocked), every connection still open on the old one is closed. Apps reconnect through the new one.

Apps: click an app to open it, or Add App to get one from the store.

Privacy:

• Paste from Mac / Copy to Mac: whether ⌘V in its apps pastes your Mac's clipboard, and whether copying in its apps reaches your Mac. Apps also need the clipboard permission.
• Disposable: its data is erased each time the sandbox stops.
• Shared folder: ~/V2Mac Sandbox/<mini VM>/Shared, seen as ~/Shared by apps you allowed. Files the mini VM writes there are marked as downloaded, so macOS checks them before they open.
  • Export… copies a file or folder from it to your Mac, marked as downloaded. It appears only once every file in it is marked. This is the safe way to take files out.
  • Show in Finder opens the folder.
  • If a file can't be marked, an orange warning appears here. Don't open that file from the Shared folder; use Export….

Right-click a mini VM in the sidebar for Open Terminal (a shell in it, through its exit), Show Shared Folder, Clone, Wipe Data… and Delete….

The store

Add App opens the V2Mac Store window. Install In at the top picks the mini VM; Source switches between:

• V2Mac Store: apps signed by the store. An app marked Reviewed by V2Mac, updated by Debian is a Debian program whose settings V2Mac reviewed and tested; Debian signs it and its updates, which arrive without a new V2Mac review.
• Debian: search any program in Debian's archive. These are signed by Debian but not reviewed by V2Mac. Window apps appear in the mini VM; command-line tools are in its Terminal. The first search of the day downloads Debian's package list, which can take a few minutes.

Debian packages are shared by all mini VMs: installing or updating one changes it in every mini VM, but their data stays separate.

The More menu has Refresh Store and Update Debian Apps Now.

Apps in the store include:

• Chromium and Firefox ESR: browsers where every site sees only the mini VM's exit, in its time zone. Chromium's own browser sandbox is off; its app notes say why.
• SSH: connect to your servers through the mini VM's exit with the SSH keys on your Mac. The keys never enter the VM.
• File Viewer: open a PDF or Office file you don't trust. Macros and links stay off.

Installing an app

Before an app installs, V2Mac lists what it asks for:

• Use the clipboard
• Read and write this mini VM's Shared folder. Without it, a file you open with the app is the only one it sees, and it has no network while it does.
• Use the SSH keys in your Mac's ssh-agent, after asking you
• Play sound, after asking you
• Use the microphone, after asking you

Choose Allow and Install, Install Without These or Cancel.

The last three are asked again when the app uses them: the first time an open app plays sound, opens the microphone or uses your SSH keys, V2Mac asks Allow, Don't Allow or Always Allow. Allow holds until the app is closed. Until you answer, the app waits; if you don't allow it, it gets nothing.

Each installed app appears as a Mac app in ~/Applications/V2Mac Sandbox, named "App — Mini VM", with an icon in the mini VM's colour. Window apps open in their own Mac window; terminal apps open in Terminal.

Opening a file in a sandbox app

Drop a file on a window app's icon, or right-click the file in Finder and use Open With. The app gets a read-only copy of only that file. If the app doesn't have the Shared folder permission, it also has no network while the file is open, so a harmful file can't send anything out. Each file opens in its own window, and the copy is deleted when the window closes.

This is how File Viewer is meant to be used: install it without the Shared folder, then drop untrusted PDFs and Office files on it.

Managing an app

Right-click an app in the Sandbox window for:

• Open.
• Permissions: for sound, the microphone and SSH keys, choose Ask, Always Allow or Don't Allow. Changing it to Ask or Don't Allow takes away what an open app is using right away; its next use asks again.
• Verify Installation…: where it came from (repository and commit), its permissions, and whether its files are unchanged since it was published. "Verified" means unchanged, not "safe". For a Debian program it says that Debian signs it and V2Mac didn't review it.
• Update to … when the store has a newer version.
• Remove. Removing an app or its mini VM also ends its SSH keys, sound or microphone at once.

An app withdrawn from the store shows a warning sign; open Verify Installation… to see why. Its data is kept.

Settings → Sandbox

• Version: the installed sandbox. When a newer sandbox is out, an update button appears beside Sandbox in the sidebar (with a notification and a card in the menu bar), and Update Now downloads it. Your mini VMs and their data stay; open sandbox apps close first. An update downloads only what changed, usually a few megabytes; a part that fails its check is downloaded in full. V2Mac looks for a new sandbox every hour; Check Now looks right away.
• Memory limit: the most memory the sandbox may use while it runs. A new limit applies from its next start.
• Disk space used, and Remove Sandbox…, which deletes the sandbox, every mini VM with its data, and the sandbox apps. You can download it again later.

Notes

• Quitting V2Mac with sandbox apps open asks whether to quit them too; they never run without V2Mac.
• The sandbox has its own connection to each mini VM's server. It keeps working when V2Mac is disconnected, on another server, or in TUN mode.
• Each app sees only its own mini VM: the place and time zone of its exit, its home folder and, if allowed, the Shared folder. Not your Mac's files, network or other mini VMs.
• One busy mini VM can't slow the others down much. Each gets at most three quarters of the sandbox's memory, 4096 processes and an equal share of the CPU. Each can hold up to 256 connections open through its exit (768 for all mini VMs together), and a connection with no traffic for 10 minutes is closed.
• Apps come from the V2Mac store, which is signed, or from Debian. Developers can make their own from the plugin template.