oh, yeah, sandbox-exec is fun. for the record, the exact scheme they use is tinyscheme. the whole facility is largely undocumented, but it still somehow manages to be friendlier than seccomp -- i remember learning about it in a talk on the nix macos effort
you can “enjoy” the sight of some c++ directly generating scheme here: https://github.com/NixOS/nix/blob/2.9.2/src/libstore/build/l...