3 ms·

Is this a real sandbox or just a pretty please?

by cozzyd 7mo ago

AnotherGoodName 7mo ago
https://code.claude.com/docs/en/sandboxing https://code.claude.com/docs/en/sandboxing says they integrated bubblewrap (linux/windows), seatbelt (macos) and give an error if sandbox can't be supported so appears to be real.
- throwaway6734 7mo ago
  https://docs.docker.com/ai/sandboxes/ https://docs.docker.com/ai/sandboxes/ Any idea on how that compares to this docker feature in development?
  - figmert 7mo ago
    Docker containers use cgroups and namespaces etc (the usual kernel level isolation) Docker sandboxes use microvms (i.e. hardware level isolation) Bubblewrap uses the same technology as containers I am unsure about seatbelt.
ray_v 7mo ago
It seems like it's controlled by the Bash tool (https://code.claude.com/docs/en/sandboxing https://code.claude.com/docs/en/sandboxing) and then bubblewrap (https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap) on linux and Seatbelt on mac at the system level
enduser 7mo ago
By default it will automatically retry many tool calls that fail due to the sandbox with the sandbox disabled. In other words it can and will leave the sandbox. For example: Bash(swift build 2>&1 | tail -20) ⎿ warning: /Users/enduser/Library/org.swift.swiftpm/configuration is not accessible or not writable, disabling user-level cache features. warning: /Users/enduser/Library/org.swift.swiftpm/security is not accessible or not writable, disabling user-level cache feat … +26 lines (ctrl+o to expand) Build hit sandbox restriction. Retrying outside sandbox. Bash(swift build 2>&1 | tail -20) ⎿ [35/52] Compiling MCP Resources.swift [36/52] Emitting module MCP [37/52] Compiling MCP Client.swift … +17 lines (ctrl+o to expand) ⎿ (timeout 3m)
- fc417fc802 7mo ago
  What is even the point in that case? The behavior you describe is no better than if SELinux were to automatically re-execute a process with containment disabled.
  - ihattendorf 7mo ago
    The purpose of the sandbox is to reduce permission fatigue. If it fails to run a command in the sandbox and retries it outside the sandbox, the regular permission rules apply. You'll still be prompted for any non-sandboxed tool calls that you haven't allowed or denied via permission rules.
  - erinnh 7mo ago
    Looking at the settings, its an option: Configure Overrides: 1. Allow unsandboxed fallback 2. Strict sandbox mode (current) Allow unsandboxed fallback: When a command fails due to sandbox restrictions, Claude can retry with dangerouslyDisableSandbox to run outside the sandbox (falling back to default permissions). Strict sandbox mode: All bash commands invoked by the model must run in the sandbox unless they are explicitly listed in excludedCommands.
  - js2 7mo ago
    Disable sandbox escape: https://news.ycombinator.com/item?id=47552165 https://news.ycombinator.com/item?id=47552165

Is this a real sandbox or just a pretty please?

by cozzyd 7mo ago

Is this a real sandbox or just a pretty please?

https://code.claude.com/docs/en/sandboxing https://code.claude.com/docs/en/sandboxing says they integrated bubblewrap (linux/windows), seatbelt (macos) and give an error if sandbox can't be supported so appears to be real.

throwaway6734 7mo ago
https://docs.docker.com/ai/sandboxes/ https://docs.docker.com/ai/sandboxes/ Any idea on how that compares to this docker feature in development?
- figmert 7mo ago
  Docker containers use cgroups and namespaces etc (the usual kernel level isolation) Docker sandboxes use microvms (i.e. hardware level isolation) Bubblewrap uses the same technology as containers I am unsure about seatbelt.

ray_v 7mo ago

It seems like it's controlled by the Bash tool (https://code.claude.com/docs/en/sandboxing https://code.claude.com/docs/en/sandboxing) and then bubblewrap (https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap) on linux and Seatbelt on mac at the system level

enduser 7mo ago

By default it will automatically retry many tool calls that fail due to the sandbox with the sandbox disabled. In other words it can and will leave the sandbox. For example: Bash(swift build 2>&1 | tail -20) ⎿ warning: /Users/enduser/Library/org.swift.swiftpm/configuration is not accessible or not writable, disabling user-level cache features. warning: /Users/enduser/Library/org.swift.swiftpm/security is not accessible or not writable, disabling user-level cache feat … +26 lines (ctrl+o to expand) Build hit sandbox restriction. Retrying outside sandbox. Bash(swift build 2>&1 | tail -20) ⎿ [35/52] Compiling MCP Resources.swift [36/52] Emitting module MCP [37/52] Compiling MCP Client.swift … +17 lines (ctrl+o to expand) ⎿ (timeout 3m)

fc417fc802 7mo ago
What is even the point in that case? The behavior you describe is no better than if SELinux were to automatically re-execute a process with containment disabled.
- ihattendorf 7mo ago
  The purpose of the sandbox is to reduce permission fatigue. If it fails to run a command in the sandbox and retries it outside the sandbox, the regular permission rules apply. You'll still be prompted for any non-sandboxed tool calls that you haven't allowed or denied via permission rules.
- erinnh 7mo ago
  Looking at the settings, its an option: Configure Overrides: 1. Allow unsandboxed fallback 2. Strict sandbox mode (current) Allow unsandboxed fallback: When a command fails due to sandbox restrictions, Claude can retry with dangerouslyDisableSandbox to run outside the sandbox (falling back to default permissions). Strict sandbox mode: All bash commands invoked by the model must run in the sandbox unless they are explicitly listed in excludedCommands.
- js2 7mo ago
  Disable sandbox escape: https://news.ycombinator.com/item?id=47552165 https://news.ycombinator.com/item?id=47552165