{"slug": "sandbox-runtime", "name": "sandbox-runtime", "category": "security", "category_name": "Security and passwords", "description": "Anthropic's open-source tool for sandboxing processes such as AI coding agents with OS-level restrictions.", "recommenders": 5, "commenters": 5, "warners": 0, "score": 4.508, "rising": 1.02, "first": "2025-11-25", "latest": "2026-10-22", "why": "HN commenters use it to confine local coding agents with strict-by-default filesystem and network restrictions enforced at the OS layer.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 5, "neutral": 0, "compare": 0, "warn": 0}, "spark": [1, 0, 1, 0, 0, 0, 0, 0, 1, 1, 0, 1], "listed": true, "loved": ["Agent containment", "OS-level enforcement"], "caveat": "Blocks dev tooling", "short_quote": "I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.", "icon": true, "domain": null, "github_repo": "github.com/anthropic-experimental/sandbox-runtime", "official_url": "https://github.com/anthropic-experimental/sandbox-runtime", "pricing": "open source", "aliases": ["sandbox-runtime"], "verdict": [{"text": "HN commenters use it to confine local coding agents", "cites": [{"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 787845264, "item_id": 49240329, "url": "https://news.ycombinator.com/item?id=49240329", "by": "bsdz", "date": "2026-08-10", "stance": "recommend", "quote": "I've started using Anthropic's sandbox runtime utility \"srt\"", "excerpt": "For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility \"srt\": https://github.com/anthropic-experimental/sandbox-runtime This is combined with \"auto\" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clickin", "context": "", "use_case": "sandboxing Claude Code", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 780141904, "item_id": 48758869, "url": "https://news.ycombinator.com/item?id=48758869", "by": "edouard-harris", "date": "2026-07-02", "stance": "recommend", "quote": "I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.", "excerpt": "> The agents have sandboxes, but those are loose. Not enforced by anything outside of the agent harness itself. You might want to check out Ant's open source srt [0], I use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "ZCode: Claude Code from the Makers of GLM"}, {"id": 745548640, "item_id": 46596790, "url": "https://news.ycombinator.com/item?id=46596790", "by": "saltypal", "date": "2026-01-12", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.", "excerpt": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { \"permissions\"", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "", "story": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir"}, {"id": 736821472, "item_id": 46051342, "url": "https://news.ycombinator.com/item?id=46051342", "by": "thomas34298", "date": "2025-11-25", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents", "excerpt": "That's the entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents for example.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Google Antigravity exfiltrates data via indirect prompt injection attack"}]}, {"text": " with strict-by-default filesystem and network restrictions enforced at the OS layer.", "cites": [{"id": 780141904, "item_id": 48758869, "url": "https://news.ycombinator.com/item?id=48758869", "by": "edouard-harris", "date": "2026-07-02", "stance": "recommend", "quote": "I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.", "excerpt": "> The agents have sandboxes, but those are loose. Not enforced by anything outside of the agent harness itself. You might want to check out Ant's open source srt [0], I use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "ZCode: Claude Code from the Makers of GLM"}, {"id": 745548640, "item_id": 46596790, "url": "https://news.ycombinator.com/item?id=46596790", "by": "saltypal", "date": "2026-01-12", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.", "excerpt": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { \"permissions\"", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "", "story": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir"}, {"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}]}, {"text": " The main caveat is that these restrictions get in the way of common workflows,", "cites": [{"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 745548640, "item_id": 46596790, "url": "https://news.ycombinator.com/item?id=46596790", "by": "saltypal", "date": "2026-01-12", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.", "excerpt": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { \"permissions\"", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "", "story": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir"}]}, {"text": " such as Xcode/Swift, Docker access, and running from home-directory locations.", "cites": [{"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 745548640, "item_id": 46596790, "url": "https://news.ycombinator.com/item?id=46596790", "by": "saltypal", "date": "2026-01-12", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.", "excerpt": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { \"permissions\"", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "", "story": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir"}]}], "praise": [{"label": "Agent containment", "summary": "Commenters use and recommend it to restrict what local coding agents can access.", "quotes": [{"id": 780141904, "item_id": 48758869, "url": "https://news.ycombinator.com/item?id=48758869", "by": "edouard-harris", "date": "2026-07-02", "stance": "recommend", "quote": "I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.", "excerpt": "> The agents have sandboxes, but those are loose. Not enforced by anything outside of the agent harness itself. You might want to check out Ant's open source srt [0], I use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "ZCode: Claude Code from the Makers of GLM"}, {"id": 787845264, "item_id": 49240329, "url": "https://news.ycombinator.com/item?id=49240329", "by": "bsdz", "date": "2026-08-10", "stance": "recommend", "quote": "I've started using Anthropic's sandbox runtime utility \"srt\"", "excerpt": "For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility \"srt\": https://github.com/anthropic-experimental/sandbox-runtime This is combined with \"auto\" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clickin", "context": "", "use_case": "sandboxing Claude Code", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 736821472, "item_id": 46051342, "url": "https://news.ycombinator.com/item?id=46051342", "by": "thomas34298", "date": "2025-11-25", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents", "excerpt": "That's the entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents for example.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Google Antigravity exfiltrates data via indirect prompt injection attack"}]}, {"label": "OS-level enforcement", "summary": "It is strict by default and relies on the built-in sandboxing on macOS and Linux.", "quotes": [{"id": 780141904, "item_id": 48758869, "url": "https://news.ycombinator.com/item?id=48758869", "by": "edouard-harris", "date": "2026-07-02", "stance": "recommend", "quote": "I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.", "excerpt": "> The agents have sandboxes, but those are loose. Not enforced by anything outside of the agent harness itself. You might want to check out Ant's open source srt [0], I use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "ZCode: Claude Code from the Makers of GLM"}, {"id": 745548640, "item_id": 46596790, "url": "https://news.ycombinator.com/item?id=46596790", "by": "saltypal", "date": "2026-01-12", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.", "excerpt": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { \"permissions\"", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "", "story": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir"}, {"id": 736821472, "item_id": 46051342, "url": "https://news.ycombinator.com/item?id=46051342", "by": "thomas34298", "date": "2025-11-25", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents", "excerpt": "That's the entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents for example.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Google Antigravity exfiltrates data via indirect prompt injection attack"}]}, {"label": "Filesystem and network controls", "summary": "It offers filesystem and network restrictions and credential masking, and a user's own checks of file access held up.", "quotes": [{"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 787845264, "item_id": 49240329, "url": "https://news.ycombinator.com/item?id=49240329", "by": "bsdz", "date": "2026-08-10", "stance": "recommend", "quote": "I've started using Anthropic's sandbox runtime utility \"srt\"", "excerpt": "For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility \"srt\": https://github.com/anthropic-experimental/sandbox-runtime This is combined with \"auto\" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clickin", "context": "", "use_case": "sandboxing Claude Code", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}]}, {"label": "Simple config", "summary": "One commenter says it balances security and convenience with simple configuration.", "quotes": [{"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}]}], "caveats": [{"label": "Blocks dev tooling", "summary": "Its intentional restrictions frequently get in the way of workflows like Xcode/Swift and Docker access.", "quotes": [{"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}]}, {"label": "Home directory denied", "summary": "Denying access to the home directory meant one user had to run Claude from a separate mounted volume.", "quotes": [{"id": 745548640, "item_id": 46596790, "url": "https://news.ycombinator.com/item?id=46596790", "by": "saltypal", "date": "2026-01-12", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.", "excerpt": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { \"permissions\"", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "", "story": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir"}]}, {"label": "Limited track record", "summary": "One user had only tried it on two small projects so far.", "quotes": [{"id": 787845264, "item_id": 49240329, "url": "https://news.ycombinator.com/item?id=49240329", "by": "bsdz", "date": "2026-08-10", "stance": "recommend", "quote": "I've started using Anthropic's sandbox runtime utility \"srt\"", "excerpt": "For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility \"srt\": https://github.com/anthropic-experimental/sandbox-runtime This is combined with \"auto\" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clickin", "context": "", "use_case": "sandboxing Claude Code", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}]}], "who": [], "tags": ["for AI coding agents", "for macOS and Linux", "open source"], "use_cases": ["sandboxing coding agents", "sandboxing claude code", "sandboxing ai coding agents", "sandboxing ai agents"], "compared": [{"slug": "claude-code", "name": "Claude Code", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50198675", "title": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49239021", "title": "Auto mode is now the default in Claude Code", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48751752", "title": "ZCode: Claude Code from the Makers of GLM", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46592344", "title": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=46048996", "title": "Google Antigravity exfiltrates data via indirect prompt injection attack", "mentions": 1}], "sentiment_by_month": {"2025-11": {"recommend": 1}, "2025-12": {}, "2026-01": {"recommend": 1}, "2026-02": {}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {"recommend": 1}, "2026-09": {}, "2026-10": {"recommend": 1}}, "quotes": [{"id": 803194352, "item_id": 50199647, "url": "https://news.ycombinator.com/item?id=50199647", "by": "thehours", "date": "2026-10-22", "stance": "recommend", "quote": "Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.", "excerpt": "In this vein, Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience. Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode. Though I'm often running into frustrating (albeit intentional) sandbox restrictions with common workflows e.g. xcode/swift and Docker access. Would love suggestions for how to give agents access", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "OpenShell \u2013 A safe, private runtime for fleets of autonomous AI agents"}, {"id": 787845264, "item_id": 49240329, "url": "https://news.ycombinator.com/item?id=49240329", "by": "bsdz", "date": "2026-08-10", "stance": "recommend", "quote": "I've started using Anthropic's sandbox runtime utility \"srt\"", "excerpt": "For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility \"srt\": https://github.com/anthropic-experimental/sandbox-runtime This is combined with \"auto\" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clickin", "context": "", "use_case": "sandboxing Claude Code", "switched_from": "", "story": "Auto mode is now the default in Claude Code"}, {"id": 780141904, "item_id": 48758869, "url": "https://news.ycombinator.com/item?id=48758869", "by": "edouard-harris", "date": "2026-07-02", "stance": "recommend", "quote": "I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.", "excerpt": "> The agents have sandboxes, but those are loose. Not enforced by anything outside of the agent harness itself. You might want to check out Ant's open source srt [0], I use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime", "context": "", "use_case": "sandboxing coding agents", "switched_from": "", "story": "ZCode: Claude Code from the Makers of GLM"}, {"id": 745548640, "item_id": 46596790, "url": "https://news.ycombinator.com/item?id=46596790", "by": "saltypal", "date": "2026-01-12", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.", "excerpt": "Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it instead) since the Deny(~) makes it impossible to run from the normal locations. export CLAUDE_CONFIG_DIR=/Volumes/Claude/.claude Minimal .claude/settings.local.json: { \"permissions\"", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "", "story": "Show HN: Yolobox \u2013 Run AI coding agents with full sudo without nuking home dir"}, {"id": 736821472, "item_id": 46051342, "url": "https://news.ycombinator.com/item?id=46051342", "by": "thomas34298", "date": "2025-11-25", "stance": "recommend", "quote": "Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents", "excerpt": "That's the entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents for example.", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Google Antigravity exfiltrates data via indirect prompt injection attack"}]}