Claude Code sandbox: what it blocks and what still runs outside it

To require the sandbox for every developer, deliver the sandbox keys through managed settings, either as a file your MDM manages or as server-managed settings. Anthropic's example turns the sandbox on, makes Claude Code refuse to start if it can't run, and closes the unsandboxed retry.

% cat managed-settings.json
{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false
  }
}

A boolean set in managed settings overrides whatever a developer sets locally. Array keys such as allowRead merge across scopes, so a developer can append entries unless a lock covers the key. The same settings stop a repository's own files from taking commands out of the sandbox. On native Windows, failIfUnavailable makes Claude Code exit at startup, so deliver the file to macOS and Linux machines only or move Windows users into WSL2.

The Bash sandbox leaves file tools, hooks and MCP servers outside, so for unattended runs Anthropic points to a wider boundary. The sandbox runtime wraps the whole Claude Code process without Docker. Dev containers, custom containers and virtual machines isolate the full environment, and cloud sessions run in a VM Anthropic hosts. Anthropic says to run --dangerously-skip-permissions only inside a container, a VM or the sandbox runtime, as a non-root user on Linux and macOS, because Claude Code refuses to start with that flag as root.

We ran these commands on 28 October 2026 with Claude Code 2.1.274 on a Mac (Apple silicon, macOS 26.4), in a throwaway folder with an empty home directory. /sandbox is an interactive panel that needs a signed-in session, so we didn't run it, and we didn't send a prompt. What we could check without an account is whether Claude Code accepts the sandbox settings above and what the operating system's own sandbox does.

% claude --version
2.1.274 (Claude Code)

% claude doctor | grep -c "Invalid settings"
0

That second command ran in a folder whose .claude/settings.json held the three-key managed example, and it found no invalid settings. In a second folder we saved "enabled": "yes" and a plain string for allowedDomains. claude doctor, trimmed here to its Invalid settings section with the working folder replaced by a dot, rejected both.

% claude doctor
Invalid settings
- ./.claude/settings.json › sandbox.enabled: Expected boolean, but received undefined
  Suggested fix: Use true or false without quotes. Example: "includeCoAuthoredBy": true
- ./.claude/settings.json › sandbox.network.allowedDomains: Expected array, but received undefined

% npm view @anthropic-ai/sandbox-runtime version time.modified license
version = '0.0.81'
time.modified = '2026-10-20T01:13:24.300Z'
license = 'Apache-2.0'

The npm record shows the open source runtime Anthropic names, at version 0.0.81 under Apache-2.0, last modified 20 October 2026. The next check isn't Claude Code. It runs the macOS Seatbelt primitive that Anthropic says Claude Code uses on Macs, with a profile we wrote ourselves, to show the two failure messages the docs list. The first command denies writes under one folder, the second writes elsewhere, and the third denies all network access.

% sandbox-exec -p "(version 1)(allow default)(deny file-write* (subpath \"$PWD/locked\"))" /usr/bin/touch locked/probe
touch: locked/probe: Operation not permitted
exit 1

% sandbox-exec -p "(version 1)(allow default)(deny file-write* (subpath \"$PWD/locked\"))" /usr/bin/touch open/probe
exit 0

% sandbox-exec -p '(version 1)(allow default)(deny network*)' /usr/bin/curl -sS -m 5 https://example.com -o /dev/null
curl: (6) Could not resolve host: example.com
exit 6

The kernel produced Operation not permitted for the write and Could not resolve host for the request, the same two messages Anthropic's table gives for a sandboxed touch and curl. That shows the mechanism. It doesn't show that Claude Code's own profile holds, which is what the check in step three above is for. Anthropic's documentation describes versions up to 2.1.302 and this machine runs 2.1.274, so a setting added since may not exist locally.