The Sandbox tab
Four switches that decide what one instance can reach, and one button to seal it.
On this page 4 sections
The Sandbox tab decides what an instance can reach. It has three parts: a header saying how locked-down the instance is, the four Gates, and Watch, which opens the Traffic Monitor.
The header#
A lock icon and one word:
| Posture | Icon | Means |
|---|---|---|
| Open | open lock, grey | Every gate is open. The instance has the network, your home folder, graphics and input. |
| Partly sealed | lock with clock, orange | Some gates are closed — the line under it says how many. |
| Sealed | closed lock, red | Every gate is closed: "no network, no share, no new windows, no input." |
On the right, one button does everything at once: Seal it closes all four gates; Open everything opens them all.
The gates#
Four switches, each Open or Cut: Network, Mac home share, Graphics (mslgd), and Keyboard & mouse. When one is cut, a line under it says exactly what that does. Each is covered in The four gates.
Gates stick#
As the card's footnote says, gates are kept across restarts and re-applied every time the instance starts or resumes — "so hibernating won't quietly hand anything back." You can close gates on a stopped instance, too; the header then says what it will have when it starts, which is the way to sandbox something before it ever runs.