# Rivox OS Process Sandboxing
Rivox isolates native compilation build steps to prevent filesystem side-effects or network exfiltration.
---
## Operating System Mechanics
- **Linux**: Unprivileged user, mount, and network namespaces (`CLONE_NEWNS`, `CLONE_NEWNET`).
- **macOS**: `/usr/bin/sandbox-exec` with dynamically generated Seatbelt (`.sb`) profiles.
- **Environment Scrubbing**: Scrubbing sensitive host secrets (`AWS_SECRET_ACCESS_KEY`, `GITHUB_TOKEN`) prior to build execution.