Claude Code sandbox: inspect file, network and fallback boundaries

When to use

• You need to identify directories and domains available to a build command.[1]

When not to use

• You need remote actions undone or intend to treat instruction files as deterministic permissions.[1]

Check platform dependencies

The docs describe Seatbelt on macOS and bubblewrap plus socat on Linux and WSL2. Use /sandbox to inspect the panel and missing dependencies, then resolve them before continuing. An ordinary Bash command running is not evidence the sandbox is enabled. Assess version and platform differences from the actual panel and documentation.[1]

Separate approval mode from isolation

Mode offers auto-allow and regular permissions. The former reduces prompts for sandboxed commands; the latter keeps normal permission prompts. Config shows resolved settings, while Overrides controls fallback to unsandboxed execution. Record that setting explicitly. A failed command should lead to diagnosis rather than unrestricted fallback.[1]

Inspect directories and domains with a disposable task

Default writes include the working directory, a per-user temp directory and explicitly added directories; protected paths remain write-denied. Default reads cover most of the machine, including credential files, so inspect denyRead and credentials protection separately. Network domains have separate approval and configuration rules. An original checklist records the command, read/write paths, domains and fallback needs. Use a disposable local directory and inspect actual approval or rejection; one successful write does not prove the same read boundary.[1]

Stop conditions and scope

Stop the command if dependencies are missing, resolved settings differ from expectations or new directories or domains are needed. This page verifies documentation only. It did not install dependencies, change settings, run /sandbox, approve a network or execute product commands. Costs depend on the model and services used; no free quota is certified. Sandboxing does not undo completed remote actions.[1]