{"record":{"id":"f831c37ebd2b4f6f","repo":"jdx/mise","slug":"per-host-network-filtering-allow-net-host-is","errorCode":null,"errorMessage":"per-host network filtering (--allow-net=<host>) is not supported on Linux. Use --deny-net to block all network, or remove --allow-net.","messagePattern":"per-host network filtering \\(--allow-net=<host>\\) is not supported on Linux\\. Use --deny-net to block all network, or remove --allow-net\\.","errorType":"validation","errorClass":"eyre::Report","httpStatus":null,"severity":"error","filePath":"src/cmd.rs","lineNumber":1544,"sourceCode":"                Err(err) => return Err(err),\n            }\n        }\n    }\n\n    /// Prepare sandbox restrictions on the command. Must be called before execute()\n    /// when sandbox is configured. This is async because macOS DNS resolution is async.\n    pub async fn apply_sandbox(&mut self) -> eyre::Result<()> {\n        let Some(sandbox) = self.sandbox.take() else {\n            return Ok(());\n        };\n        if !sandbox.is_active() {\n            return Ok(());\n        }\n\n        // Fail early on Linux if per-host network filtering is requested\n        #[cfg(target_os = \"linux\")]\n        if !sandbox.allow_net.is_empty() {\n            eyre::bail!(\n                \"per-host network filtering (--allow-net=<host>) is not supported on Linux. \\\n                 Use --deny-net to block all network, or remove --allow-net.\"\n            );\n        }\n\n        #[cfg(target_os = \"linux\")]\n        {\n            // On Linux, clear inherited env before pre_exec so child only sees filtered vars.\n            // env_clear() also wipes envs explicitly set via .envs(), so save and restore them.\n            if sandbox.effective_deny_env() {\n                let saved: Vec<(std::ffi::OsString, std::ffi::OsString)> = self\n                    .cmd\n                    .as_std()\n                    .get_envs()\n                    .filter_map(|(k, v)| v.map(|v| (k.to_os_string(), v.to_os_string())))\n                    .collect();\n                self.cmd.env_clear();\n                for (k, v) in saved {","sourceCodeStart":1526,"sourceCodeEnd":1562,"githubUrl":"https://github.com/jdx/mise/blob/9dcfcaa0dc8747a2577d3270b69bb9d8313b2807/src/cmd.rs#L1526-L1562","documentation":"CmdLineRunner::apply_sandbox() configures the platform sandbox for a command; on Linux it only implements all-or-nothing network blocking, so a sandbox spec with per-host allow_net entries fails fast before spawn (src/cmd.rs:1545-1551) with an explicit message pointing at --deny-net. This is a deliberate guard: per-host filtering is only implemented for the macOS sandbox profile.","triggerScenarios":"Running a mise task with per-host network allows on Linux: `mise run --allow-net=registry.npmjs.org my-task`, or a task/config declaring sandbox allow_net hosts, on any Linux kernel.","commonSituations":"A sandboxed task config authored/tested on macOS then executed in a Linux CI container; users trying to permit just a package registry while sandboxing builds.","solutions":["Drop the per-host allow on Linux: run with `--deny-net` (block all network) and pre-fetch dependencies before the sandboxed step","Remove `--allow-net`/allow_net so the task runs unsandboxed for network purposes","Move the sandboxed-network-permission step to a macOS runner if per-host semantics are required"],"exampleFix":"# before (Linux)\nmise run --allow-net=registry.npmjs.org build\n\n# after — pre-fetch, then block all network\nnpm ci\nmise run --deny-net build","handlingStrategy":"validation","validationCode":"# gate per-host network allows by platform before invoking mise\nif [ \"$(uname -s)\" = \"Linux\" ]; then\n  mise run --deny-net build     # no per-host support on Linux\nelse\n  mise run --allow-net=registry.example.com build\nfi","typeGuard":"fn supports_per_host_allow_net() -> bool { #![cfg(target_os = \"macos\")] true } // compile-time platform guard: per-host allow_net is macOS-only in mise's sandbox","tryCatchPattern":"If you drive mise programmatically, inspect the stderr for 'per-host network filtering' and fail with a platform-specific hint instead of retrying with the same flags on Linux.","preventionTips":["Document platform-specific sandbox flags in task READMEs","Design sandboxed tasks to need zero network; fetch inputs before sandboxing","In cross-platform CI matrices, parameterize the sandbox flags per OS"],"tags":["sandbox","linux","network","cli","platform-support"],"backgroundTag":"unsupported-platform-feature","analyzedSha":"9dcfcaa0dc8747a2577d3270b69bb9d8313b2807","analyzedAt":"2026-08-17T14:28:50.624Z","schemaVersion":2},"datasetVersion":"2026-08-21T13:17:26.733Z"}