macOS strong jail #7

It has been a real PITA to make pf in macOS reliably filter/proxy traffic for just one process due to limitations in where group selectors can be used. See also macOS's official statement "Packet Filter is not API". There's a modern macOS swift API called NETransparentProxyProvider.

The complexity of that approach includes:

• Getting the appropriate entitlements from Apple
• Including some Swift in the build toolchain

And, I'm unsure whether the UX would be truly seamless.