firstrun's static preview runs on every platform Go supports. The live
syscall trace is implemented with ptrace and currently targets
linux/amd64; everywhere else, firstrun automatically uses the static preview.
| Platform | Static preview | Live syscall trace |
|---|---|---|
| Linux / amd64 | ✅ | ✅ |
| Linux / arm64 | ✅ | ⛔ (falls back to static) |
| macOS (Intel / Apple Silicon) | ✅ | ⛔ (falls back to static) |
| Windows | ✅ | ⛔ (falls back to static) |
Run firstrun doctor to see exactly what's available on your machine, including
a quick self-test of the tracer.
firstrun traces a child it launches itself, so it works as an unprivileged user.
On systems with the Yama LSM (/proc/sys/kernel/yama/ptrace_scope = 1, the
common default) tracing your own direct children is still allowed, so no extra
setup is needed.
If firstrun itself runs inside a seccomp-filtered sandbox (some CI runners and
container setups), the tracer still works: it neutralizes syscalls by redirecting
them to a harmless getuid rather than to an invalid syscall number, so it never
trips a filter's SIGSYS. See
docs/how-it-works.md.
Tracing inside a container needs CAP_SYS_PTRACE, which Docker drops by default.
Add --cap-add=SYS_PTRACE (or --privileged) if you want the live preview
inside a container. Without it, firstrun falls back to the static preview.
- linux/arm64 — the engine is the same; only the register/argument decoding is architecture-specific. This is the most tractable port and a great first contribution (see CONTRIBUTING.md).
- macOS —
ptraceis heavily restricted; a real backend would use DTrace or the Endpoint Security framework. Under exploration. - Windows — would use the debug API plus a filesystem/registry filter. Not yet started.
In all of these cases the static preview is fully functional today — you still get the plain-English explanation, the predicted effects, and the risk flags. You just don't get the syscall-level confirmation that the live trace provides.