Homebrew 6.0 sandbox: what the systemd confinement actually does (opens in new tab)

Homebrew 6.0 shipped a Linux sandbox. Here's what that actually means in practice. The short version The sandbox isn't containers. It's systemd sleep confinement applied per-formula at install/run time. When a formula runs, systemd places it in a cgroup slice with restricted access to filesystem paths, syscall capabilities, and device nodes. If the formula tries to write somewhere it shouldn't, the kernel enforces it at the cgroup level — not at the container boundary. Why this matters for de...