Preview. These maps are our reading of public sources and haven't been checked with the projects' maintainers yet.
Claude Code sandboxing
Claude Code's built-in OS-level sandbox for shell commands (Seatbelt on macOS, bubblewrap on Linux/WSL2) with filesystem limits and a domain-allowlist proxy, so sandboxed commands can run without per-command approval. Built on the open-source sandbox-runtime.
Built into Claude Code; underlying @anthropic-ai/sandbox-runtime v0.0.81 released 2026-10-20 (repo moved from anthropic-experimental to anthropics, pushed 2026-10-25). (checked 2026-10-25)
In Agent guardrails
Where it stands apart
- How is the main thing licensed? open parts around a closed core (10% of 21 others)
- Can it run entirely on your own device or infrastructure, without the maker's servers? partly (some features need the maker's servers) (14% of 21 others)
- Do you need an account to use it? account required (24% of 21 others)
- Which shared standard or format does it mainly build on? OS sandbox primitives (Seatbelt, bubblewrap, Linux namespaces, seccomp) (14% of 21 others)
- If the guard itself breaks, is missing, or cannot decide, what happens by default? fails open: the action runs unguarded (12% of 17 others)
- Which agents does it work with? one specific agent (19% of 21 others)
- Does it control the agent's outbound network access? yes, deny by default or allowlist by default (6% of 16 others)
What it shares with most of the community
- Is it actively maintained? active (81% of 21 others)
- How is it mainly sustained? company with a paid product, tier, or ads (50% of 20 others)
- Who is it for? developers (90% of 21 others)
- What mainly decides whether an action is allowed? rules, policy, or boundaries written in advance (57% of 21 others)
- What is the main thing it protects? the developer's machine and files (52% of 21 others)
- Is enforcement kept out of the agent's reach? yes, enforced in code or infrastructure the agent cannot change (95% of 21 others)
Nearest neighbors
- OpenAI Codex sandbox 88% of 16 shared answers match
- Daytona 59% of 17 shared answers match
- Drop 59% of 17 shared answers match
Every answer
| Question | Answer | Source |
|---|---|---|
| Is it actively maintained? | active | source 2026-10-25 |
| How is the main thing licensed? | stands apart open parts around a closed core sandbox-runtime is Apache-2.0; Claude Code itself is proprietary. | source 2026-10-25 |
| How is it mainly sustained? | company with a paid product, tier, or ads Part of Anthropic's paid Claude Code product. | source 2026-10-25 |
| Can it run entirely on your own device or infrastructure, without the maker's servers? | stands apart partly (some features need the maker's servers) The sandbox runs entirely locally; the agent needs Anthropic's hosted models. | source 2026-10-25 |
| Do you need an account to use it? | stands apart account required Claude Code needs a Claude subscription or Console account (or cloud provider) to log in; sandbox is a feature of it. | source 2026-10-26 |
| Who is it for? | developers | source 2026-10-25 |
| Which shared standard or format does it mainly build on? | stands apart OS sandbox primitives (Seatbelt, bubblewrap, Linux namespaces, seccomp) Seatbelt on macOS, bubblewrap on Linux/WSL2. | source 2026-10-26 |
| Where does it mainly step in? | at the OS or VM boundary (sandbox, container, syscall supervisor) | source 2026-10-25 |
| What mainly decides whether an action is allowed? | rules, policy, or boundaries written in advance allowRead/allowWrite and allowedDomains set in advance; a person is prompted the first time a new domain is needed (a classifier reviews in auto mode). | source 2026-10-25 |
| If the guard itself breaks, is missing, or cannot decide, what happens by default? | stands apart fails open: the action runs unguarded 'By default, if the sandbox can't start ... Claude Code runs commands without sandboxing.' failIfUnavailable and allowUnsandboxedCommands:false make it fail closed. | source 2026-10-25 |
| Which agents does it work with? | stands apart one specific agent Answered for Claude Code's sandbox; sandbox-runtime alone can wrap any process. | source 2026-10-25 |
| In the default setup, where does the agent's work actually execute? | in a local VM, container, or OS sandbox | source 2026-10-25 |
| What is the main thing it protects? | the developer's machine and files | source 2026-10-25 |
| Does it keep a record of agent actions? | no, or not a focus | source 2026-10-25 |
| Does it control the agent's outbound network access? | stands apart yes, deny by default or allowlist by default Connections go through a local proxy; allowed domains 'start empty'. | source 2026-10-25 |
| What is it mainly for? | letting agents run with fewer approvals, safely 'Claude Code can run sandboxed commands without asking you to approve each one.' | source 2026-10-25 |
| Is enforcement kept out of the agent's reach? | yes, enforced in code or infrastructure the agent cannot change OS-enforced; but the model can request an unsandboxed retry (dangerouslyDisableSandbox), which then goes through normal permissions unless disabled. | source 2026-10-25 |
Sources
This page was derived from:
- GitHub · github.com/anthropics/sandbox-runtime · read 2026-10-25
- Web page · code.claude.com/docs/en/sandboxing · read 2026-10-25
Are you a maintainer? Claiming and correcting projects is coming soon.