isobox: Run a command in a sandbox, with the same flags on every OS ↗ github.com

isobox is a Go CLI that compiles one sandbox policy to each OS's native mechanism: Seatbelt on macOS, gVisor on Linux, and AppContainer on Windows. Instead of pretending every backend is equal, it uses an explicit capability model that flags where enforcement falls short, and a strict mode that refuses anything that isn't portable.