anthropics/sandbox-runtime

In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access to those kinds of tooling inside the sandbox, either with srt or an alternative (with similar convenience characteristics). [0] https://github.com/anthropics/sandbox-runtime

> The agents have sandboxes, but those are loose. Not enforced by anything outside of the agent harness itself. You might want to check out Ant's open source srt [0], I use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime

... interestingly, Anthropic's SRT is built on the same macOS primitives and DOES support the network configuration I'm looking for: https://github.com/anthropics/sandbox-runtime/tree/main#as-a-library const config: SandboxRuntimeConfig = { network: { allowedDomains: ['example.com', 'api.github.com'], deniedDomains: [], }, filesystem: { denyRead: ['~/.ssh'], allowWrite: ['.', '/tmp'], denyWrite: ['.env'], }, }

For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility "srt": https://github.com/anthropic-experimental/sandbox-runtime This is combined with "auto" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clicking through prompts and recently switched to "auto" mode. I'm not quite sure why anyone would trust "--dangerously-skip-permissions". I've seen these agents go off-piste far too many times, installing unnecessary packages, environments, calling sudo & creating files in all sor…

Check out https://github.com/anthropic-experimental/sandbox-runtime , which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { "permissions": { "allow": [ "Read(/)", "Read(~/.claude/shell-snapshots/\*)", "WebSearch", "WebFetch(domain:example.com)" ], "deny": [ "Read(~)", "Write(/.claude/settings.local.json)", "Write(/method_filter.py)" ] }, "sandbox": { "enabled": true, "autoAllowBashIfSandboxed": true, "allowUn…

That's the entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents for example.

If I understand correctly, Claude Code will(shortly, if not already) make use of Anthropic's sandbox that wraps Seatbelt on OS X, not sandbox-exec? It's cool that they made this open source. It seems straightforward and useful enough that it could be used on its own for sandboxing purposes. https://docs.claude.com/en/docs/claude-code/sandboxing https://github.com/anthropic-experimental/sandbox-runtime

They have an annoying sandbox issue which pollutes your repository root with a set of empty files. Not the cleanest tool, but the paradigm is a big upgrade to previous AI coding. .bash_profile .bashrc .claude .env .gitconfig .gitmodules .idea .mcp.json .profile .ripgreprc .vscode .zprofile .zshrc config https://github.com/anthropic-experimental/sandbox-runtime/issues/139

FYI the sandbox feature is not fully baked and does not seem to be high priority. For example, for the last 3 weeks using the sandbox on Linux will almost-always litter your repo root with a bunch of write-protected trash files[0] - there are 2 PRs open to fix it, but Anthropic employees have so far entirely ignored both the issue and the PRs. Very frustrating, since models sometimes accidentally commit those files, so you have to add a bunch of junk to your gitignore. And with claude code being closed source and distributed as a bun standalone executable it's difficult to patch the bug yourself. [0]: https://github.com/anthropic-experimental/sandbox-runtime/issues/85

/sandbox AFAIK uses https://github.com/anthropic-experimental/sandbox-runtime under the hood. It's still experimental and if you dive into the issues I would call its protection light. Many users experiences erratic issues with perms not being enforced, etc. For me the largest limitation was that it's read-mode is deny-only, meaning that with an empty deny-list it can read all files on your laptop. Restricting to specific domains have worked fine for me, but it can't block on specific ports, so you can't say for instance you may access these dev-server ports, but not dev-server ports belonging to another sandbox. It feels as though the primary usecase is running inside an already network…

> By default, all network access is denied. Your `network.allowLocalBinding` flag, when enabled, allows data exfiltration via DNS. This isn't clear from the docs. I made an issue for that here: https://github.com/anthropic-experimental/sandbox-runtime/issues/88