Anthropic Sandbox Runtime
Open-source CLI and library (srt) that restricts filesystem and network access for any local process at the OS level, without a container or VM. Excellent lightweight guardrail for local agents; pair with a VM for untrusted multi-tenant code.
Overview
Sandbox Runtime is the OS-level sandbox developed for Claude Code and released as open source. It wraps any process with filesystem write restrictions and a deny-by-default network proxy, using native OS mechanisms instead of a VM.
Because there is no VM, it starts instantly and works on the host filesystem — but it is a weaker boundary than a microVM and is labelled a beta research preview.
Notable
- Labelled “Beta Research Preview”.
- Reads allowed by default; writes denied by default.
Anthropic Sandbox Runtime specifications
| Attribute | Details |
|---|---|
| Isolation | OS-level: macOS Seatbelt profiles; Linux bubblewrap with network namespace removed and traffic forced through host proxies; Windows support in alpha |
| Deployment | Local / OS-level · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | CLI (srt), TypeScript (npm) |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | Operates on the host filesystem; writes only to explicitly allowed paths |
| GPU | Not documented |
| Networking | Deny-all by default; domain allowlists and denylists enforced by host HTTP and SOCKS5 proxies |
| Pricing | Free and open source |
| Free tier | Open source |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Anthropic Sandbox Runtime’s public documentation, verified November 8, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want near-zero-overhead sandboxing for a local agent or CLI
- You need strict network allowlisting on a developer machine
- You want to wrap existing tools without containers
Trade-offs
- OS-level boundary, weaker than a VM
- Beta; configuration format may change
- Not a hosted or multi-tenant service
Best for: Lightweight local sandboxing of coding agents and CLI tools.
Where Anthropic Sandbox Runtime ranks
How Anthropic Sandbox Runtime compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
Head-to-head: Docker Sandboxes vs Anthropic Sandbox Runtime
Frequently asked questions
What is Anthropic Sandbox Runtime?
srt) that restricts filesystem and network access for any local process at the OS level, without a container or VM. Excellent lightweight guardrail for local agents; pair with a VM for untrusted multi-tenant code.How does Anthropic Sandbox Runtime isolate code?
Is Anthropic Sandbox Runtime open source?
How much does Anthropic Sandbox Runtime cost?
What are the best Anthropic Sandbox Runtime alternatives?
Sources
Cite this page
Agent Sandboxes. (2026). Anthropic Sandbox Runtime. agentsandboxes.org. Last reviewed November 8, 2026. https://agentsandboxes.org/sandboxes/anthropic-srt/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.