{"record":{"id":"335ff84c7bff5492","repo":"jdx/mise","slug":"per-host-network-filtering-allow-net-host-is-335ff8","errorCode":null,"errorMessage":"per-host network filtering (--allow-net=<host>) is not supported on Linux. Use --deny-net to block all network, or remove --allow-net.","messagePattern":"per-host network filtering \\(--allow-net=<host>\\) is not supported on Linux\\. Use --deny-net to block all network, or remove --allow-net\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sandbox/mod.rs","lineNumber":222,"sourceCode":"        {\n            return self.apply_macos(program, args).await;\n        }\n\n        #[cfg(not(any(target_os = \"linux\", target_os = \"macos\")))]\n        {\n            warn!(\"sandbox is not supported on this platform, running unsandboxed\");\n            Ok(None)\n        }\n    }\n\n    #[cfg(all(not(test), target_os = \"linux\"))]\n    fn apply_linux(&self) -> eyre::Result<()> {\n        if self.effective_deny_read() || self.effective_deny_write() {\n            landlock::apply_landlock(self)?;\n        }\n        if self.effective_deny_net() {\n            if !self.allow_net.is_empty() {\n                eyre::bail!(\n                    \"per-host network filtering (--allow-net=<host>) is not supported on Linux. \\\n                     Use --deny-net to block all network, or remove --allow-net.\"\n                );\n            }\n            seccomp::apply_seccomp_net_filter()?;\n        }\n        Ok(())\n    }\n\n    #[cfg(all(not(test), target_os = \"macos\"))]\n    async fn apply_macos(\n        &self,\n        program: &str,\n        args: &[String],\n    ) -> eyre::Result<Option<SandboxedCommand>> {\n        let profile = macos::generate_seatbelt_profile(self).await;\n        let mut sandbox_args = vec![\n            \"-p\".to_string(),","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/sandbox/mod.rs#L204-L240","documentation":"On Linux, mise's network sandbox is an all-or-nothing seccomp filter installed by seccomp::apply_seccomp_net_filter; per-host allow-listing is only implemented on macOS (endpoint-security based). If effective_deny_net() is true and any --allow-net=<host> entries were supplied on Linux, apply_linux bails with this message instead of silently ignoring the host list.","triggerScenarios":"On Linux, running e.g. `mise x --sandbox --deny-net --allow-net=registry.npmjs.org -- npm install` — any combination where --deny-net (or a config equivalent enabling network denial) is active together with a non-empty --allow-net list.","commonSituations":"Writing cross-platform task definitions or CI scripts that copy macOS sandbox flags to Linux; hardening a build step but still needing one registry host; switching development from macOS to Linux (or Linux CI) with the same flags.","solutions":["Remove the --allow-net=<host> flags and keep plain --deny-net to block all network on Linux.","Split the work: run the networked step unsandboxed (no --deny-net) and the pure build step with --deny-net.","Guard flags per-OS in tasks/scripts (e.g. separate linux/macos task variants or shell conditionals) so macOS uses allow-lists and Linux uses deny-all."],"exampleFix":"# before (fails on Linux)\nmise x --sandbox --deny-net --allow-net=registry.npmjs.org -- npm ci\n# after (Linux): block everything, or run networked step outside sandbox\nmise x --sandbox --deny-net -- ./build-offline.sh\nmise x -- npm ci","handlingStrategy":"validation","validationCode":"#!/usr/bin/env bash\nif [ \"$(uname -s)\" = \"Linux\" ] && [[ \"$*\" == *\"--allow-net=\"* ]] && [[ \"$*\" == *\"--deny-net\"* ]]; then\n  echo 'error: --allow-net=<host> is macOS-only; on Linux use --deny-net alone' >&2\n  exit 1\nfi\nexec mise x --sandbox \"$@\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep sandbox flags in per-OS task definitions or shell guards instead of shared literals.","On Linux, design steps as either fully offline (--deny-net) or normally networked.","Document in the task file which platforms the sandbox flags support."],"tags":["mise","sandbox","network","linux","seccomp","platform-support"],"backgroundTag":"unsupported-platform-feature","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}