6.8 · App groups, keychain groups and extensions as separate processes

An app and its extensions are different processes in different sandboxes. Sharing between them is allowed only through the doors the system provides, and each door has a hazard attached.

Mental model. Two processes cannot share memory or files by default. An app group and a keychain access group are the sanctioned shared spaces, both granted by entitlements.

Shared spaces

The group container and shared keychain items.

1. What is an app group, and what can go wrong when an app and an extension share a database? 6.8.1 · L3
   An app group is an identifier (group.com.example.app) that several apps and extensions from the same team can declare in their entitlements. Members get a…
2. How do keychain access groups differ from app groups? 6.8.2 · L3
   The keychain is a separate secure store, managed by a system service, not a folder. Items are tagged with an access group (kSecAttrAccessGroup). An app can…

Extensions

Why an extension is a separate program, and what that implies.

1. Why is an app extension a separate process, and what does that mean for how you build it? 6.8.3 · L3
   An extension (share sheet, widget, notification service, keyboard, Siri intent and many more) is a separate executable inside your app’s bundle, launched by…

More in iOS platform internals

• 6.1 · The process, the sandbox, entitlements and privacy prompts
• 6.2 · App and scene lifecycle in UIKit and SwiftUI
• 6.3 · The run loop, its modes, and the main-thread contract
• 6.4 · The launch path: dyld, initialisers and the first frame
• 6.5 · Background modes, BGTaskScheduler and background transfers
• 6.6 · Memory warnings, jetsam and the watchdog
• 6.7 · Info.plist, URL schemes, universal links and associated domains
• 6.9 · How a process dies, what it costs, what confines it and what seals it
• 6.10 · Threads and run loops, observers, and what actually runs in a custom mode
• 6.11 · Launch arguments, the scene callbacks, and reading a binary and its plists