---
name: "dot_sandbox"
section: "1"
platform: "linux"
package: "graphviz"
version: "16.1.0-2"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/dot_sandbox"
---

# dot\_sandbox(1)

Graphviz sandbox

## NAME

dot\_sandbox - Graphviz sandbox

## SYNOPSIS

**dot\_sandbox** *options...*

## DESCRIPTION

This program is a wrapper around Graphviz. It aims to provide a safe environment for the processing of untrusted input graphs and command line options. More precisely:

- •

  No network access will be allowed.

- •

  The file system will be read-only. Command line options like **-o ...** and **-O** will not work. It is expected that the caller will render to **stdout** and pipe the output to their desired file.

The command line options to **dot\_sandbox** are command line options to be passed to **dot**. Options are passed through unmodified.

The following sandboxing mechanisms are supported:

- •

  Bubblewrap

- •

  macOS **sandbox-exec**

## SEE ALSO

[**dot**(1)](/dot/1.md), [**bwrap**(1)](/bwrap/1.md), **sandbox-exec**(1)