@anthropic-ai/sandbox-runtime
container-ishsandbox-libraryopen sourceAnthropic's standalone process-sandbox library, Seatbelt on macOS, bubblewrap + seccomp on Linux, behind one interface with an proxy.
sandbox-runtime (srt) is the open-source sandbox that powers Claude Code's opt-in /sandbox mode, usable on its own. On macOS it uses Seatbelt; on Linux it uses bubblewrap for the filesystem view plus seccomp reserved for the narrow job of blocking Unix-socket creation so the agent cannot sidestep the network proxy. runs default-deny through a local proxy enforcing a hostname allowlist, with optional TLS termination and credential masking. It exposes rich filesystem allow/deny config. A local inspection of the Claude Code binary found references to bwrap, seccomp, and sandbox_init/seatbelt, and no Landlock.
Notable syscalls
are the verbs a program asks the kernel for; each links to its man page.
Strengths
- Cross-platform: one interface over Seatbelt (macOS) and bubblewrap + seccomp (Linux)
- Default-deny egress proxy with hostname allowlist and credential masking
- Open source and usable standalone, independent of Claude Code
Limitations
- Shared-kernel process sandbox, not a hardware boundary for hostile code
- On Linux depends on bubblewrap (user namespaces) rather than an LSM
- Filesystem/egress policy must be configured correctly to be meaningful