{
  "id": 10207968,
  "title": "What App Sandbox actually takes away from a Mac disk cleaner",
  "url": "https://urgent.news/2026/09/27/what-app-sandbox-actually-takes-away-from-a-mac-disk-cleaner",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-27T12:03:39.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/ran_guo_5ed7f647ab1b09c50/what-app-sandbox-actually-takes-away-from-a-mac-disk-cleaner-5cmo"
  },
  "original_language": "en",
  "account": "A disk cleaner is an App Sandbox app that faces multiple limitations. The sandboxed version cannot scan the entire disk, only the user's home directory and certain application folders. The direct download version, however, can scan additional system roots. Reading the user's Library folder requires one explicit user gesture, and this is enforced every time the app launches. A sandboxed app cannot access ~/Library directly, instead relying on a bookmark stored in UserDefaults. The sandbox also restricts certain entitlements, such as com.apple.security.temporary-exception.files.home-relative-path.read-write, which would typically allow a cleaner to read files outside its defined scope. The sandboxed build also lies about the home directory returned by NSHomeDirectory(), making it unusable for scanning purposes. Another limitation is the inability to empty the Trash, as the sandboxed version does not have the necessary entitlement for Finder automation. Lastly, the sandboxed build cannot spawn subprocesses, so it relies on the direct build to report Docker's reclaimable space.",
  "summary": "A disk cleaner is a badly-shaped citizen of the App Sandbox: its whole job is to look at files the user did not explicitly pick. DiskWise ships twice — one build inside the sandbox (Mac App Store), one outside it (direct download) — and the two builds are not the same program. Same binary logic, different capabilities. This post is the list of differences, each one pinned to a line in the public…",
  "key_points": [
    "Disk cleaner sandboxed version limited to user's home directory and certain app folders",
    "Direct download version can scan additional system roots",
    "Sandbox restricts accessing ~/Library folder directly"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}