[Experimental] Add Sandboxy binary (#607)

Sandboxy is an example tool to run isolated coding agents.

Author: dcantah

.github/workflows/containerization-build-template.yml

@@ -50,9 +50,9 @@ jobs:
           make protos
           if ! git diff --quiet ; then echo the following files require formatting or license headers: ; git diff --name-only ; false ; fi
 
-      - name: Make containerization and docs
+      - name: Make containerization, examples, and docs
         run: |
-          make clean containerization docs
+          make clean containerization examples docs
           tar cfz _site.tgz _site
         env:
           BUILD_CONFIGURATION: ${{ inputs.release && 'release' || 'debug' }}

Makefile

@@ -203,8 +203,8 @@ swift-fmt:
 	@$(SWIFT) format --recursive --configuration .swift-format -i $(SWIFT_SRC)
 
 swift-fmt-check:
-	   @echo Checking code formatting compliance...
-	   @$(SWIFT) format lint --recursive --strict --configuration .swift-format-nolint $(SWIFT_SRC)
+	@echo Checking code formatting compliance...
+	@$(SWIFT) format lint --recursive --strict --configuration .swift-format-nolint $(SWIFT_SRC)
 
 .PHONY: update-licenses
 update-licenses:
@@ -246,6 +246,14 @@ cleancontent:
 	@echo Cleaning the content...
 	@rm -rf ~/Library/Application\ Support/com.apple.containerization
 
+.PHONY: examples
+examples:
+	@echo Building examples...
+	@mkdir -p bin
+	@"$(MAKE)" -C examples/sandboxy build BUILD_CONFIGURATION=$(BUILD_CONFIGURATION)
+	@install examples/sandboxy/bin/sandboxy ./bin/
+	@codesign --force --sign - --timestamp=none --entitlements=signing/vz.entitlements bin/sandboxy
+
 .PHONY: clean
 clean:
 	@echo Cleaning build files...

examples/sandboxy/Makefile

@@ -0,0 +1,38 @@
+# Copyright © 2026 Apple Inc. and the Containerization project authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+BUILD_CONFIGURATION ?= debug
+SWIFT = /usr/bin/swift
+SWIFT_STRIP := $(if $(filter release,$(BUILD_CONFIGURATION)),-Xlinker -s)
+BUILD_BIN_DIR = $(shell $(SWIFT) build -c $(BUILD_CONFIGURATION) --show-bin-path)
+
+.PHONY: all build clean run fmt
+
+all: build
+
+build:
+	$(SWIFT) build -c $(BUILD_CONFIGURATION) $(SWIFT_STRIP)
+	@mkdir -p bin
+	@install "$(BUILD_BIN_DIR)/sandboxy" ./bin/
+	codesign --force --sign - --entitlements sandboxy.entitlements ./bin/sandboxy
+
+clean:
+	$(SWIFT) package clean
+	rm -rf bin
+
+run: build
+	./bin/sandboxy
+
+fmt:
+	$(SWIFT) format --in-place --recursive Sources/

examples/sandboxy/Package.resolved

@@ -0,0 +1,57 @@
+// swift-tools-version: 6.2
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the Containerization project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+import PackageDescription
+
+let containerizationVersion = "0.26.5"
+
+let package = Package(
+    name: "sandboxy",
+    platforms: [
+        .macOS("26.0")
+    ],
+    products: [
+        .executable(
+            name: "sandboxy",
+            targets: ["sandboxy"]
+        )
+    ],
+    dependencies: [
+        .package(url: "https://github.com/apple/containerization.git", from: "0.30.0"),
+        .package(url: "https://github.com/apple/swift-argument-parser.git", from: "1.3.0"),
+        .package(url: "https://github.com/apple/swift-log.git", from: "1.0.0"),
+        .package(url: "https://github.com/apple/swift-nio.git", from: "2.65.0"),
+        .package(url: "https://github.com/swift-server/async-http-client.git", from: "1.20.1"),
+    ],
+    targets: [
+        .executableTarget(
+            name: "sandboxy",
+            dependencies: [
+                .product(name: "Containerization", package: "containerization"),
+                .product(name: "ContainerizationExtras", package: "containerization"),
+                .product(name: "ContainerizationOS", package: "containerization"),
+                .product(name: "ContainerizationArchive", package: "containerization"),
+                .product(name: "AsyncHTTPClient", package: "async-http-client"),
+                .product(name: "NIOCore", package: "swift-nio"),
+                .product(name: "NIOPosix", package: "swift-nio"),
+                .product(name: "NIOHTTP1", package: "swift-nio"),
+                .product(name: "ArgumentParser", package: "swift-argument-parser"),
+                .product(name: "Logging", package: "swift-log"),
+            ],
+        )
+    ]
+)