Module vfkit 

macOS sandbox backend built on vfkit (Virtualization.framework).

vfkit is a command-line VMM, so this shells out rather than linking a C API. That is deliberate: a process spawn is cheap next to a VM boot, and it keeps unsafe FFI out of a published crate.

Device syntax is vfkit’s own type,key=value grammar from its doc/usage.md: -d virtio-fs,sharedDir=<host>,mountTag=<tag>, mounted in the guest as mount -t virtiofs <tag> <dir>.

Like libkrun, vfkit has no snapshot/restore, so every invocation pays a full guest boot. Read-only grants cannot be expressed (a virtio-fs share is writable), so this backend reports that rather than widening the policy.

Structs

VfkitSandbox

A macOS backend that runs each command in its own vfkit guest.

Functions

which

Find vfkit on PATH.