DOT\_SANDBOX(1) General Commands Manual DOT\_SANDBOX(1)

# [NAME](#NAME)

dot\_sandbox - Graphviz sandbox

# [SYNOPSIS](#SYNOPSIS)

**dot\_sandbox** *options...*

# [DESCRIPTION](#DESCRIPTION)

This program is a wrapper around Graphviz. It aims to provide a safe environment for the processing of untrusted input graphs and command line options. More precisely:

•

No network access will be allowed.

•

The file system will be read-only. Command line options like **-o ...** and **-O** will not work. It is expected that the caller will render to **stdout** and pipe the output to their desired file.

The command line options to **dot\_sandbox** are command line options to be passed to **dot**. Options are passed through unmodified.

The following sandboxing mechanisms are supported:

•

Bubblewrap

•

macOS **sandbox-exec**

# [SEE ALSO](#SEE_ALSO)

[**dot**(1)](/man/os/graphviz/dot.1), [**bwrap**(1)](/man/os/graphviz/bwrap.1), [**sandbox-exec**(1)](/man/os/graphviz/sandbox-exec.1)

---

Document: dot_sandbox(1) from graphviz 16.1.0-r0 (Chainguard OS)
Source: https://gitlab.com/graphviz/graphviz