Anthropic sandbox-runtime
Hacker ApprovedRanked 8 of 17 agent sandboxes by recommenders
Recommended for filesystem and network isolation of AI coding agents, with simple config and OS-level enforcement. Critics say it cannot block specific ports.
Recommended for filesystem and network isolation of AI coding agents, with simple config and OS-level enforcement. Critics say it cannot block specific ports.
16 people gave an opinion
- recommend it
- 11
- criticize it
- 5
- approval share
- 69%
Recommended in 6 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it carries the badge
- 11 people recommend itNeeds 10 or more, met.
- 2.2 recommenders for every criticNeeds 2 to 1 or better, met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Native OS-level enforcement
“Anthropic's SRT is built on the same macOS primitives and DOES support the network configuration I'm looking for”
Comment from 9 Oct 2026 in “MXC - a sandboxed code execution system” “which tackles this problem using the built-in userspace sandboxing on macOS and Linux”
Comment from 13 Jan 2026 in “Show HN: Yolobox – Run AI coding agents with full sudo without nuking home dir” “It's strict by default and enforced at the OS layer.”
Comment from 2 Jul 2026 in “ZCode: Claude Code from the Makers of GLM” Filesystem and network isolation
“Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode.”
Comment from 22 Oct 2026 in “OpenShell – A safe, private runtime for fleets of autonomous AI agents” “Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc.”
Comment from 10 Aug 2026 in “Auto mode is now the default in Claude Code” “If you just need filesystem + network isolation and you're in the Node ecosystem, sandbox-runtime is great.”
Comment from 25 Jan 2026 in “Show HN: Fence – Sandbox CLI commands with network/filesystem restrictions” Strict defaults and good governance
“It's strict by default and enforced at the OS layer.”
Comment from 2 Jul 2026 in “ZCode: Claude Code from the Makers of GLM” “Anthropic's out-of-the-(sand)box is good governance”
Comment from 5 Mar 2026 in “Tell HN: AI Lies About Having Sandbox Guardrails” Domain-based network restrictions work
“Anthropic's SRT is built on the same macOS primitives and DOES support the network configuration I'm looking for”
Comment from 9 Oct 2026 in “MXC - a sandboxed code execution system” “Restricting to specific domains have worked fine for me, but it can't block on specific ports”
Comment from 21 Jan 2026 in “Running Claude Code dangerously (safely)”
What people warn about
Each mark is one comment
Teams fork it for missing features
“Anthropic's tool only support read blacklist, not a whitelist, so I forked it yesterday to support that”
Comment from 9 Mar 2026 in “Agent Safehouse – macOS-native sandboxing for local agents” “We're using a minimal fork that also works w Codex and has a lot more logging on top.”
Comment from 1 Jan 2026 in “Observed Agent Sandbox Bypasses”
Other agent sandboxes people recommend
The four most recommended other agent sandboxes, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| Docker Sandboxes | 50 | 39 | 56% | 9 | — | — |
| NVIDIA OpenShell | 36 | 8 | 82% | 9 | — | Approved |
| Claude Code sandbox | 16 | 18 | 47% | 6 | — | — |
| MXC (Microsoft Execution Containers) | 15 | 17 | 47% | 1 | — | — |
| Anthropic sandbox-runtimeThis page | 11 | 5 | 69% | 6 | — | Approved |
What people said
15 of the 17 comments that mention it, newest first. Each links to the original comment.
“Isn't using a sandbox provided by them giving you more restrictions though?”
“Simple config, filesystem and network restrictions, and credential masking make me comfortable running Pi in YOLO mode.”
“Anthropic's SRT is built on the same macOS primitives and DOES support the network configuration I'm looking for”
“Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc.”
“It's strict by default and enforced at the OS layer.”
“Anthropic's tool only support read blacklist, not a whitelist, so I forked it yesterday to support that”
“Anthropic's out-of-the-(sand)box is good governance”
“I opened an issue about this on day 1 of the release”
“The runtime has one bug and needs one improvement”
“If you just need filesystem + network isolation and you're in the Node ecosystem, sandbox-runtime is great.”
“Restricting to specific domains have worked fine for me, but it can't block on specific ports”
“which tackles this problem using the built-in userspace sandboxing on macOS and Linux”
“That sandbox gives default read only access to your entire drive. It's kinda useless IMO.”
“Your `network.allowLocalBinding` flag, when enabled, allows data exfiltration via DNS. This isn't clear from the docs.”
“We're using a minimal fork that also works w Codex and has a lot more logging on top.”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.