A macOS sandbox tool for safer command-line work on a Mac server
painless-belt is a small for running macOS commands with tighter limits. A program launched through it cannot read files, write files, or use the network unless those actions are allowed.
It is written in Rust and is run with the short command name pb. It includes ready-made profiles, including one for Claude Code, so a profile can be downloaded and then used to run that tool inside a restricted environment.
Under the surface, it uses macOS Seatbelt and builds SBPL profiles with s. The project is available on GitHub at shshemi/painless-belt.
Key points
- painless-belt runs macOS commands inside a restricted sandbox.
- File reading, file writing, and network access can be blocked unless allowed.
- Ready-made profiles are included, including one for Claude Code.
- The tool is written in Rust and uses the short command name pb.
- The project is published on GitHub as shshemi/painless-belt.