Claude Code

nonecli

Has a real native sandbox, but it is opt-in, the default posture runs with your full privileges behind approval prompts.

documentedClaude Code sandboxing docs ↗

By default Claude Code runs shell commands with your full OS privileges, gated only by approval prompts, the sandbox is opt-in via /sandbox or sandbox.enabled. When enabled it uses bubblewrap + seccomp on Linux/WSL2 (denying ptrace, process_vm_readv/writev, io_uring) and Seatbelt on macOS, packaged as the standalone @anthropic-ai/sandbox-runtime (srt). Sandboxed is default-deny through a local hostname-allowlist proxy. --dangerously-skip-permissions is rejected under root.

Isolation tech (linux)

bubblewrap seccomp-BPF @anthropic-ai/sandbox-runtime

Isolation tech (macos)

Seatbelt (macOS App Sandbox)@anthropic-ai/sandbox-runtime

Escape hatch

--dangerously-skip-permissions

Sources

anthropics/claude-code