{"record":{"id":"335ff84c7bff5492","repo":"jdx/mise","slug":"per-host-network-filtering-allow-net-host-is-335ff8","errorCode":null,"errorMessage":"per-host network filtering (--allow-net=<host>) is not supported on Linux. Use --deny-net to block all network, or remove --allow-net.","messagePattern":"per-host network filtering \\(--allow-net=<host>\\) is not supported on Linux\\. Use --deny-net to block all network, or remove --allow-net\\.","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/sandbox/mod.rs","lineNumber":333,"sourceCode":"        {\n            return self.apply_macos(program, args).await;\n        }\n\n        #[cfg(not(any(target_os = \"linux\", target_os = \"macos\")))]\n        {\n            warn!(\"sandbox is not supported on this platform, running unsandboxed\");\n            Ok(None)\n        }\n    }\n\n    #[cfg(all(not(test), target_os = \"linux\"))]\n    fn apply_linux(&self, program: &str) -> eyre::Result<()> {\n        if self.effective_deny_read() || self.effective_deny_write() || self.deny_process {\n            landlock::apply_landlock(self, Some(std::path::Path::new(program)))?;\n        }\n        if self.effective_deny_net() || self.deny_process {\n            if !self.allow_net.is_empty() {\n                eyre::bail!(\n                    \"per-host network filtering (--allow-net=<host>) is not supported on Linux. \\\n                     Use --deny-net to block all network, or remove --allow-net.\"\n                );\n            }\n            seccomp::apply_seccomp_filter(self.effective_deny_net(), self.deny_process)?;\n        }\n        Ok(())\n    }\n\n    #[cfg(all(not(test), target_os = \"macos\"))]\n    async fn apply_macos(\n        &self,\n        program: &str,\n        args: &[String],\n    ) -> eyre::Result<Option<SandboxedCommand>> {\n        let profile =\n            macos::generate_seatbelt_profile(self, Some(std::path::Path::new(program))).await;\n        let mut sandbox_args = vec![","sourceCodeStart":315,"sourceCodeEnd":351,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/sandbox/mod.rs#L315-L351","documentation":"On Linux, mise's sandbox implements network restriction with seccomp, which can only deny network syscalls wholesale — it cannot filter by destination host. If per-host allow rules were requested (`--allow-net=<host>`) alongside deny-net or deny-process, `apply_linux` bails explaining that only full denial is supported and pointing at `--deny-net`.","triggerScenarios":"Running `mise x --allow-net=registry.npmjs.org --deny-net ... -- <cmd>` (or deny_process set) on Linux: any non-empty `allow_net` combined with `effective_deny_net()` or `deny_process` triggers the bail.","commonSituations":"Users porting macOS sandbox (seatbelt) invocations that support per-host filtering to Linux; CI scripts sharing flags across platforms; intending 'allow only this host' which Linux seccomp cannot express here.","solutions":["Drop the `--allow-net=<host>` flags on Linux and rely on `--deny-net` to block all network.","Remove `--deny-net` entirely if the command needs network access.","Implement host filtering outside mise (firewall/nftables rules or a userspace proxy) when per-host control is required on Linux."],"exampleFix":"// before\nmise x --allow-net=registry.npmjs.org --deny-net -- npm publish\n// after\nmise x -- npm publish  # or: mise x --deny-net -- make offline-test","handlingStrategy":"validation","validationCode":"if (process.platform === 'linux' && allowNetHosts.length > 0)\n  throw new Error('--allow-net=<host> is not supported on Linux; use --deny-net only');","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Gate platform-specific sandbox flags on `uname`/platform checks in scripts.","On Linux use only all-or-nothing network control (--deny-net) or external firewall rules for per-host filtering."],"tags":["sandbox","linux","network","seccomp"],"backgroundTag":"unsupported-platform","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}