← All tech

@anthropic-ai/sandbox-runtime

container-ishsandbox-libraryopen source

Anthropic's standalone process-sandbox library, Seatbelt on macOS, bubblewrap + seccomp on Linux, behind one interface with an proxy.

sandbox-runtime (srt) is the open-source sandbox that powers Claude Code's opt-in /sandbox mode, usable on its own. On macOS it uses Seatbelt; on Linux it uses bubblewrap for the filesystem view plus seccomp reserved for the narrow job of blocking Unix-socket creation so the agent cannot sidestep the network proxy. runs default-deny through a local proxy enforcing a hostname allowlist, with optional TLS termination and credential masking. It exposes rich filesystem allow/deny config. A local inspection of the Claude Code binary found references to bwrap, seccomp, and sandbox_init/seatbelt, and no Landlock.

Notable syscalls

are the verbs a program asks the kernel for; each links to its man page.

Strengths

  • Cross-platform: one interface over Seatbelt (macOS) and bubblewrap + seccomp (Linux)
  • Default-deny egress proxy with hostname allowlist and credential masking
  • Open source and usable standalone, independent of Claude Code

Limitations

  • Shared-kernel process sandbox, not a hardware boundary for hostile code
  • On Linux depends on bubblewrap (user namespaces) rather than an LSM
  • Filesystem/egress policy must be configured correctly to be meaningful

Sources