macos_vz

Module: backend::macos_vz

Contents

Structs

• VzBackend - macOS runtime backend.

---

firma_run::backend::macos_vz::VzBackend

Struct

macOS runtime backend.

Operates in one of three modes:

• Compatibility mode (default): sandbox-exec + HTTP_PROXY injection. Proxy-only; requires --allow-non-structural. Equivalent to the current macOS compatibility baseline.

• Sandbox-exec structural mode (FIRMA_RUN_VZ_STRUCTURAL_NETWORK=1): sandbox-exec with deny network-outbound policy that restricts the wrapped process to the Firma proxy bridge and DNS stub on loopback — the re-allow is port-scoped to those endpoints, so other host loopback services (admin ports, daemons, MCP servers) are denied too. This mode reports structural=true with network_confinement=macos_sandbox_network_deny. This is an intermediate structural step before the guest-backed path.

• VZ guest structural mode (FIRMA_RUN_VZ_GUEST=1): launch a configured host runner with an explicit JSON contract. The runner owns the Virtualization.framework lifecycle and must boot a guest whose only usable egress path is the sidecar bridge provided in the contract. This mode reports structural=true with network_confinement=macos_vz_guest.

Unit Struct

Trait Implementations:

• Debug
  • fn fmt(self: &Self, f: & mut $crate::fmt::Formatter) -> $crate::fmt::Result
• SandboxBackend
  • fn kind(self: &Self) -> BackendKind
  • fn prepare(self: &Self, request: &PrepareRequest) -> Result<SandboxHandle, RunError>
  • fn enforce_network(self: &Self, _handle: &SandboxHandle, policy: &NetworkPolicy) -> Result<EnforcementProof, RunError>
  • fn verify_fail_closed(self: &Self, _handle: &SandboxHandle, proof: &EnforcementProof) -> Result<(), RunError>
  • fn start_agent(self: &Self, _runtime_layout: &firma_runtime_state::RuntimeLayout, handle: &SandboxHandle, launch: &LaunchSpec) -> Result<Child, RunError>
  • fn teardown(self: &Self, handle: SandboxHandle) -> Result<(), RunError>
• Default
  • fn default() -> VzBackend