V2Mac

Secure Sandbox Beta

Every app in its own mini VM, with its own server. If that server stops working, the app is cut off. It never falls back to your real connection.

Download for Mac

Version 1.6.0 · 28 MB · macOS 26+ · Apple Silicon

A mini VM, then an app in your Dock

  1. Open Sandbox

    Click Sandbox in V2Mac. The first time, a sheet shows the download size and how much memory it may use.

  2. Add a mini VM

    Start empty, from a template with a ready set of apps, or clone one you have.

  3. Pick its exit

    Choose the server its traffic leaves from. Each mini VM has its own.

  4. Add an app

    It appears in ~/Applications/V2Mac Sandbox as its own Mac app, with an icon in the mini VM’s colour.

Each mini VM shows its exit

Cut the server. Watch where it stops.

The app’s traffic has one way out: the server you picked.

The server stops working. Traffic stops inside the mini VM, and you get one notification. Pick another server; V2Mac never switches on its own.

The sandbox has its own connection to each server. It keeps working when V2Mac is disconnected, on another server or in TUN mode.

What’s inside, and what isn’t

An app sees

  • The place and time zone of its exit
  • Its own home folder
  • The Shared folder, if you allow it

An app never sees

  • Your Mac’s files
  • Your Mac’s network
  • Other mini VMs

You decide what it gets

Before an app installs, V2Mac lists what it asks for. Choose Allow and Install, Install Without These, or Cancel.

The last three ask again when the app uses them: Allow, Don’t Allow or Always Allow. Until you answer, the app waits. If you don’t allow it, it gets nothing.

You choose whether ⌘V pastes your Mac’s clipboard and whether copying reaches your Mac, for each mini VM. Files a mini VM writes to Shared are marked as downloaded, so macOS checks them before they open.

Keep it or throw it away

Disposable

Its data is erased whenever the sandbox stops.

Clone

A copy of a mini VM, with its apps and data.

Wipe Data

Empty a mini VM and keep the mini VM.

Why you can check it

A signed store

Apps come from the V2Mac store, whose index is signed.

Verify Installation

Shows where an app came from (repository and commit), its permissions, and whether its files are unchanged. “Verified” means unchanged, not “safe”.

Withdrawn apps

An app withdrawn from the store shows a warning sign and the reason. Its data is kept.

A pinned download

V2Mac accepts only the exact sandbox version it was released with, so a changed download is refused.

Apps, and making your own

Chromium is in the store today. Developers can build their own app from the plugin template and submit it to the store.

Plugin template · The store

What it costs you

It’s a beta

Expect rough edges and a short list of apps. Sandbox apps never run without V2Mac: quitting V2Mac asks whether to quit them too. It needs macOS 26 or later on Apple Silicon, like V2Mac.

Questions.

Can I run one app through a VPN server on my Mac?

Yes. Put the app in a mini VM and pick a server for it. Nothing that app does reaches the internet any other way. It keeps working while the rest of your Mac uses another server or no server.

What happens if the server stops working?

The apps in that mini VM lose the internet and you get one notification. They never fall back to your normal connection, and V2Mac never switches server on its own.

Can a sandbox app read my Mac’s files?

No. It sees its own home folder and, if you allow it, the mini VM’s Shared folder at ~/V2Mac Sandbox/<mini VM>/Shared.

Does it download anything if I never use it?

No. Nothing is downloaded until you open the sandbox for the first time, and you see the size before you agree.

How do I remove it?

Settings → Sandbox → Remove Sandbox… deletes the sandbox, every mini VM with its data, and the sandbox apps.

Download for Mac