Skip to main content
An install script runs with your user rights. It can read your SSH keys, your cloud credentials, and every secret in your shell environment. The PMG sandbox runs the package manager and its scripts under an operating system policy that blocks these reads. The sandbox:
  • Blocks reads and writes of credential files such as .env, .ssh, .aws, and .netrc.
  • Removes known secret variables, such as AWS_SECRET_ACCESS_KEY and GITHUB_TOKEN, from the package manager environment.
  • Blocks host unix sockets, such as the SSH agent and the Docker daemon.
  • Blocks writes to Git hooks and Git config.
The sandbox runs on macOS (Seatbelt) and Linux (Landlock on kernel 5.13 or later, or Bubblewrap). It does not run on Windows. The sandbox is off by default.

​
Turn on the sandbox

1

Enable the sandbox

2

Check the sandbox driver

The output shows the driver that PMG uses on this machine. On Ubuntu 23.10 and later, follow the AppArmor fix that the doctor shows.
3

Install a package

PMG applies the sandbox to install commands. Other commands, such as npm run build, run without it.
To try the sandbox for one command without a config change, add --sandbox:

​
Fix a denied operation

A denied operation fails in the package manager with a permission error. PMG records the denials that the sandbox driver reports. The Landlock and Bubblewrap drivers do not report every denial. See the sandbox debug commands.
1

Find the cause

The output names the denied path, command, or variable, and the command that allows it.
2

Allow it for one run

The types are read, write, exec, net-connect, net-bind, env, and preset. For a removed variable, use env=NAME.
3

Keep it for this repository

PMG saves the allowance in a project overlay outside the repository, and applies it on every run in this repository. A cloned repository cannot add an overlay. Show the overlay with pmg sandbox project show.
pmg sandbox allow refuses a credential file, such as .env or .npmrc, unless you add --force. A package that reads the file during an install can send it to an attacker.

​
Use a preset for a known tool

A preset is a set of allowances for one tool, such as a dev server. Use a preset instead of allowing each denial:
A preset only adds allowances. It cannot remove a deny rule or open a credential file.

​
With SafeDep Cloud

The sandbox is free in PMG. With SafeDep Cloud, you see the sandbox allowances on every endpoint of your team. PMG records each --sandbox-allow and each project allowance as a sandbox override event. This query lists the endpoints that use an override, and the number of sessions on each:
This section needs the SafeDep Cloud Team or Enterprise plan, with PMG connected to your tenant. See pricing.

​
Next steps

For the profile format, custom profiles, and platform limits, see the sandbox documentation in the PMG repository.

Limit the Hosts a Package Install Can Reach

Allow only the registries an install needs.

Sandbox Your AI Coding Agent

Run Claude Code, Codex, or Pi in the PMG sandbox.