# Anthropic sandbox-runtime

11 Hacker News commenters recommended Anthropic sandbox-runtime and 5 criticized it, November 2025 to November 2026. It was recommended in 6 of 13 months. It meets the Hacker Approved badge rule.

**Verdict:** Recommended for filesystem and network isolation of AI coding agents, with simple config and OS-level enforcement. Critics say it cannot block specific ports.

## Why people recommend it

- Native OS-level enforcement (3 comments): "Anthropic's SRT is built on the same macOS primitives and DOES support the network configuration I'm looking for" ([source](https://news.ycombinator.com/item?id=50020234)) "which tackles this problem using the built-in userspace sandboxing on macOS and Linux" ([source](https://news.ycombinator.com/item?id=46596790)) "It's strict by default and enforced at the OS layer." ([source](https://news.ycombinator.com/item?id=48758869))
- Filesystem and network isolation (3 comments): "Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode." ([source](https://news.ycombinator.com/item?id=50199647)) "Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc." ([source](https://news.ycombinator.com/item?id=49240329)) "If you just need filesystem + network isolation and you're in the Node ecosystem, sandbox-runtime is great." ([source](https://news.ycombinator.com/item?id=46758443))
- Strict defaults and good governance (2 comments): "It's strict by default and enforced at the OS layer." ([source](https://news.ycombinator.com/item?id=48758869)) "Anthropic's out-of-the-(sand)box is good governance" ([source](https://news.ycombinator.com/item?id=47265709))
- Domain-based network restrictions work (2 comments): "Anthropic's SRT is built on the same macOS primitives and DOES support the network configuration I'm looking for" ([source](https://news.ycombinator.com/item?id=50020234)) "Restricting to specific domains have worked fine for me, but it can't block on specific ports" ([source](https://news.ycombinator.com/item?id=46703035))

## What people warn about

- Teams fork it for missing features (2 comments): "Anthropic's tool only support read blacklist, not a whitelist, so I forked it yesterday to support that" ([source](https://news.ycombinator.com/item?id=47306100)) "We're using a minimal fork that also works w Codex and has a lot more logging on top." ([source](https://news.ycombinator.com/item?id=46452428))

## Alternatives hackers recommend

- [Docker Sandboxes](https://hackerapproved.com/p/docker-sandboxes.md): 50 recommend
- [NVIDIA OpenShell](https://hackerapproved.com/p/openshell.md): 36 recommend
- [Claude Code sandbox](https://hackerapproved.com/p/claude-code-sandbox.md): 16 recommend
- [MXC (Microsoft Execution Containers)](https://hackerapproved.com/p/mxc.md): 15 recommend
- [microsandbox](https://hackerapproved.com/p/microsandbox.md): 13 recommend

## Cite as

Hacker Approved, "Anthropic sandbox-runtime", https://hackerapproved.com/p/anthropic-sandbox-runtime/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).