brewdo is a wrapper for Homebrew that sandboxes the installation process, giving you the following advantages:
Your user account loses write rights to
/usr/local, making it much harder to accidentally break your Homebrew-installed software (or other
Software installations lose write rights to your home directory and other places outside
/usr/local, blocking those installations from modifying things they're not supposed to
You can cleanly share Homebrew admin rights among multiple users of the same system
sudo(1), but not to run commands as
root; rather, to
run Homebrew under a dedicated sandbox user account.
brewdo grew out of the experiment in my blog post, Sandboxing Homebrew.
brewdo works and I use it personally, but I do recommend you make
sure your system is backed up before running
brewdo install or
brewdo has been tested on:
- macOS 10.13 High Sierra (primary development platform)
- macOS 10.11 El Capitan
In the past, brewdo was also tested as far back as macOS 10.8 Mountain Lion, and I think it should still work there.
If you have a new system with no
/usr/local at all, you can install
brewdo by first running
sudo ./brewdo install in your Git clone; this
will set up the sandbox user and Homebrew into a new
When this is done, you can optionally run
./brewdo do make install to
brewdo program and its man page into
/usr/local so you
can use it across your whole system.
You can also run
brewdo directly out of your Git clone; the program
is an entirely self-contained script.
brewdo.1.ronn is the
Ronn-formatted man page for
that you can read directly to get information on using the program.
How it works
brewdo requires a sandbox user account (traditionally
This user account is switched to using Sudo whenever you use brewdo
to execute a Homebrew command, unless that command is known to not
require write rights to the Homebrew root (e.g.
The environment is set so that brewdo-wrapped Homebrew uses the new
system-wide log directory (
/var/log/homebrew, which was chosen
because Console.app finds it transparently).
brewdo also takes care of extra steps required by some formulae,
such as creating (and cleaning up) a temporary home directory.