sandbox-runtime
Anthropic's open-source tool for sandboxing processes such as AI coding agents with OS-level restrictions.
HN commenters use it to confine local coding agents12345 with strict-by-default filesystem and network restrictions enforced at the OS layer.678 The main caveat is that these restrictions get in the way of common workflows,910 such as Xcode/Swift, Docker access, and running from home-directory locations.1112
Why people recommend it
Agent containment · 3
Commenters use and recommend it to restrict what local coding agents can access.
“I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.”
“I've started using Anthropic's sandbox runtime utility "srt"”
Show 1 more
“Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents”
OS-level enforcement · 3
It is strict by default and relies on the built-in sandboxing on macOS and Linux.
“I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.”
“Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.”
Show 1 more
“Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents”
Filesystem and network controls · 2
It offers filesystem and network restrictions and credential masking, and a user's own checks of file access held up.
“Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.”
“I've started using Anthropic's sandbox runtime utility "srt"”
Simple config · 1
One commenter says it balances security and convenience with simple configuration.
“Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.”
Caveats and dissent
Blocks dev tooling · 1
Its intentional restrictions frequently get in the way of workflows like Xcode/Swift and Docker access.
“Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.”
Home directory denied · 1
Denying access to the home directory meant one user had to run Claude from a separate mounted volume.
“Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.”
Limited track record · 1
One user had only tried it on two small projects so far.
“I've started using Anthropic's sandbox runtime utility "srt"”
Often compared with
Threads where it came up
- OpenShell – A safe, private runtime for fleets of autonomous AI agents 1 mention
- Auto mode is now the default in Claude Code 1 mention
- ZCode: Claude Code from the Makers of GLM 1 mention
- Show HN: Yolobox – Run AI coding agents with full sudo without nuking home dir 1 mention
- Google Antigravity exfiltrates data via indirect prompt injection attack 1 mention
Data: sandbox-runtime.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 5
“Anthropic's sandbox-runtime [0] has struck a good balance between security and convenience.”
“I've started using Anthropic's sandbox runtime utility "srt"”
“I use it to contain my local coding agents. It's strict by default and enforced at the OS layer.”
“Check out https://github.com/anthropic-experimental/sandbox-runtime, which tackles this problem using the built-in userspace sandboxing on macOS and Linux.”
“Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents”