microsoft/mxc

Microsoft has mxc which I think is neat — not sure if it’s the right level of abstraction for your needs https://github.com/microsoft/mxc

This is promising, but there's one feature that's missing that I really care about: fine-grained networking. They have this for Windows and Linux, but it's sadly missing for macOS - see the support table here: https://github.com/microsoft/mxc/blob/main/docs/backends/seatbelt/seatbelt-backend.md#what-seatbelt-can-and-cant-enforce Things macOS is missing include "Allow/deny by hostname" and "Allow/deny by IP, CIDR, port, or protocol". The rest all looks great, and if you are on Linux or Windows those restrictions don't apply. I guess this is the universal challenge of building an abstraction layer over multiple different technologies.

Most of the features are undocumented. I think because most of the behavior is not really defined and varies greatly between the different backends. The backends are also not documented, you need to try out what's working and what isn't working. It doesn't explain the supported and unsupported features of each backend, neither their quirks. A lot of behavior is surprising. For example if you have powershell in path on windows inside MXC it will just silently add the whole C drive with read-only permissions. Circumventing all other policies. https://github.com/microsoft/mxc/issues/1455 A lot of common error cases regularly happen and don't provide reasonable error messages. No documentatio…