Hardlink sandbox for Mac OS

[matthewjh]

Description of the feature request:

The hardlink sandbox, toggled via experimental_use_hermetic_linux_sandbox, is a step forward in ensuring the hemeticity of build actions and tests as tools are no longer able to "accidentally" follow symlinks out of the sandbox to pick up files outside of the source set specified. This also means tools don't have to be hacked, patched, or reconfigured in error-prone and unsound ways to respect Bazel's sandbox.

It would be great to extend this feature beyond Linux to MacOS. In our case, all our developers use Macs whereas our CI uses Linux. It is unfortunate that, due to the lack of hardlink sandbox on the former, the development environment behaves differently - in both subtle and significant ways - to the CI.

Which category does this issue belong to?

No response

What underlying problem are you trying to solve with this feature?

No response

Which operating system are you running Bazel on?

No response

What is the output of bazel info release?

No response

If bazel info release returns development version or (@non-git), tell us how you built Bazel.

No response

What's the output of git remote get-url origin; git rev-parse HEAD ?

No response

Have you found anything relevant by searching the web?

No response

Any other information, logs, or outputs that you want to share?

No response

[brentleyjones]

When using hardlinks on macOS (which the sandboxfs implementation did at one point), you can run into issues of Gatekeeper randomly killing your process: https://developer.apple.com/forums/thread/663456 and https://jmmv.dev/2020/01/osxfuse-hardlinks-dladdr.html