title: Is there a way to chroot/sandbox a go os.exec call (prevent rm -rf /)
body: <p>I want to test/automate some repositories, the basic flow is something like:</p>
  
  <pre><code>repos := []string{"repo 1", "repo 2", ...}
  for r := range repos {
      // git clone the repo 
      // cd repo dir
      // make test
      // make build
      // ...
  }
  </code></pre>
  
  <p>I am doing this with <a href="https://golang.org/" rel="nofollow">GO</a> using  <code>os.exec</code> to call the all the series of commands, something like:</p>
  
  <pre><code> exec.Command("sh", "-c", "git clone project")
  </code></pre>
  
  <p>So far so good, but I would like to know if there is a way to secure/protect against something miswriting on the Makefile that could be doing something like <code>rm -rf /</code>. and break my host.</p>
  
  <p>Basically I would like to use the system libraries/tools but restrict/chroot only the output to a specific <code>workdir</code>, so that I can avoid pre-build a chroot for this.</p>
  
  <p>A working solution is to use a <a href="https://www.freebsd.org/doc/handbook/jails.html" rel="nofollow">FreeBSD jail</a>, but I would like to know if there an alternative/secure way of doing this without the need of containers,virtualbox,etc; and using a basic Mac OS X workstation. so that anyone could "safely" run &amp; test without worries.</p>
  
  <p>Any ideas ?</p>