Have you seen Leash? https://github.com/strongdm/leash https://github.com/strongdm/leash It even has a --darwin macOS-native mode which goes beyond the capabi

Have you seen Leash? https://github.com/strongdm/leash https://github.com/strongdm/leash It even has a --darwin macOS-native mode which goes beyond the capabilities and guarantees of sandbox-exec and bubblewrap. Full-disclosure: I am one of the authors.