Xcode Cloud custom build script sandbox restrictions

Xcode Cloud provides a managed CI/CD environment that allows the execution of custom build scripts for pre- and post-build tasks. These scripts are essential for automating environment setup, dependency management, and artifact processing within the Apple ecosystem.

Because these scripts run within a managed infrastructure, they are subject to specific sandbox restrictions to maintain security and environment stability. This creates uncertainty when attempting to interact with system-level resources or external network endpoints that may not be explicitly whitelisted by the managed runner.

• What are the specific filesystem boundaries and read/write permissions enforced on custom scripts?
• Which system binaries or third-party tools are pre-installed and available for execution within the sandbox?