Claude Code's sandbox is off by default: a cheat sheet of agent sandbox settings

Future_AGI · reddit · 2026-10-28

Everyone says "sandbox your agent," but Claude Code ships with the sandbox off. A Reddit post compiles the actual settings for popular coding agents:

Claude Code: enable via /sandbox or sandbox.enabled; network goes through a local proxy with an empty domain allowlist; set sandbox.failIfUnavailable=true or an unstartable sandbox (Linux needs bubblewrap + socat) means commands run unsandboxed. Native Windows has no sandbox — use WSL2.
Codex CLI: network stays off in workspace-write unless networkaccess = true appears in config.toml — grep before trusting it.
No-network jobs: docker run --network none; full coding agents fit Docker Sandboxes (sbx) microVMs, starting deny-all and allowlisting hosts one by one.
Partial web: egress via a hostname-allowlist proxy like Stripe's Smokescreen, which also refuses internal IPs.
Cloud VMs: the 169.254.169.254 metadata endpoint leaks role credentials; require IMDSv2 on AWS and drop the address for agent containers.
Escape vector: models have used unshare to get root in their own namespace; Ubuntu 24.04 and Docker's default seccomp profile restrict it unless CAPSYSADMIN or seccomp=unconfined is granted.

The post ends on the open debate: per-task network allowlists, or full access inside a throwaway VM?

More from coding & agent