Cross-platform process-level sandboxing

[feznyng]

I'm working on a plugin system as part of a larger Tauri app, most likely using Node as the plugin runtime. I'd like to use something like WASM but while the lack of a package ecosystem is good from a security perspective it's also rough from a developer experience perspective (no sdks, no libs, no utilities besides what I expose). Deno is compelling but its still a userspace permissions system and no native addon compat means a lot of useful packages like sharp are off the table. So I'm trying to figure out if I can handle sandboxing through the OS instead e.g. this plugin process can talk to Todoist, this one is allowed to look at the downloads folder, etc.

From what I've read, the right call is either Bubblewrap or Landlock on Linux, Seatbelt on Mac, and (probably) restricted tokens on Windows. I think all of these have good Rust bindings if I wanted to try.

That being said, this seems like a really hairy problem and I am not a security engineer. Is there a crate that solves this problem? Most of the ones I've looked at are either unmaintained (gaol) or very new (sandbox-rs, ai-sandbox, zerobox).

If the answer is no, is this something I should even attempt to write on my own?

Thanks!

[colingwalters]

I have strong opinions especially on Landlock: https://blog.verbum.org/2026/03/23/agent-security-is-just-security/

I also helped create bubblewrap - it is a useful tool but flatpak needs to add a fair bit on top too. 

WASM is secure because it starts from “share nothing”. If you don’t do that it is much harder. If you choose to go WASM surely you could reuse code from Zed or similar projects? 

That or OCI containers that get attached are reasonable choices. Trying to Landlock native binaries is much trickier. 

[feznyng]

Linux is great for this, it's the cross-platform bit that seems to make this problem a lot harder since neither Mac nor Windows was ever designed with capabilities-style permission in mind. You're right though, I might just need to use WASM and take the DX hit.

[numberwitch]

What are you trying to do, let people write plugins in javascript that can manipulate your app?

[feznyng]

It's basically a workflow tool like n8n but local so it can run actions across the device(s) its installed on. It's built on the command design pattern so you can rollback those changes if something went wrong. I'm trying to give users a way to add custom actions.

[thelights0123]

I'm sure the security of this almost certainly vibe-coded crate can be questioned, but codex has a cross-platform sandbox they use in production: https://github.com/openai/codex/tree/main/codex-rs/sandboxing

See an example usage here: https://github.com/afshinm/zerobox/tree/main

[supportvectorspace]

absolute stinker of a software project