Qualify Apple container as the first macOS sandbox backend

[sarthakagrawal927]

Why

Sandbox isolation is core to execution-backed verification. This host qualifies for Apples supported path (arm64 and macOS 27), but the container CLI is not installed. The official signed installer requires administrator authorization and starts a system service, so the trial stopped at the correct boundary instead of mutating the host silently.

Requirement

A sandbox backend SHALL demonstrate deterministic command execution, filesystem containment, default-deny secret mounts, bounded resources, explicit network policy, teardown, and attributable runtime evidence before CodeVetter depends on it.

First trial

Use Apples signed container CLI before embedding libkrun. It provides a maintained macOS 26+ OCI-compatible path and lets CodeVetter measure the product contract before taking on an in-process VMM dependency.

Tasks

• Owner approves and performs the signed administrator installation.
• Record installer release, signature, CLI version, host OS, architecture, and service state.
• Run a no-network hello-world container with CPU, memory, wall-time, and teardown receipts.
• Verify workspace mounting is read-only by default and escaping paths are rejected.
• Verify environment, home directories, SSH material, and credentials are absent.
• Measure cold start, warm start, image size, idle resources, and cleanup reliability.
• Compare the resulting adapter contract with libkrun and Virtualization.framework options.
• Decide whether to invoke the CLI, consume Containerization as a library, or continue to libkrun.
• Add no production dependency until the measured tradeoff and signing/notarization impact are approved.

Evidence

Discovered during #193. Host probe: Apple silicon arm64, macOS 27.0; container command absent. Official requirements support Apple silicon on macOS 26 and newer.

[sarthakagrawal927]

Qualified Apple Container 1.3.1 on arm64 macOS 27 after owner-authorized installation. Publisher digest and Developer ID/notarization checks matched; the service is running on API server commit a9a62e28. The bounded Alpine trial used 1 CPU, 256 MB, read-only root/workspace, dropped capabilities, an internal no-DNS network, and no inherited host marker/home/SSH path. Cold image/init-image run was 20.56s; cached no-op was 0.61s; teardown left zero containers/volumes. Important failure: a controlled bind source containing .. successfully resolved to a sibling fixture, so the CLI does not enforce CodeVetter workspace containment. The adapter must canonicalize and reject out-of-root sources itself. Tracked receipt: evidence/verification/apple-container-qualification-2026-08-31.md. Architecture choice and remaining measurements stay open.