macOS processes › Security and privacy
What is sandboxd on Mac?
sandboxd is part of the App Sandbox, the system that limits what apps can access. It mostly records when a sandboxed app tries to do something it isn't allowed to do.
What it does
The sandbox rules are enforced by the kernel. sandboxd helps by handling and logging violations, which developers and the Console app can read. App Store apps and most Apple processes run sandboxed.
Why it gets busy
- An app repeatedly trying to access something it isn't allowed to, which creates a stream of violations.
- A recently updated app that doesn't yet work within its sandbox rules.
Why is sandboxd using so much CPU?
sandboxd is busy when an app keeps hitting the limits of its sandbox. Console's deny messages name the app, and updating it usually solves it.
Is it safe to quit?
macOS restarts it on demand. The sandbox keeps working because the kernel enforces it.
How to calm it down
- Open Console and search for “deny” to see which app is hitting sandbox limits.
- Update that app or report the problem to its developer.
- Restart your Mac if it doesn't settle.
In SystemWatch
SystemWatch's History shows whether sandboxd's spikes match a particular app running, which narrows down the one breaking its sandbox.
