sandbox-runtime

Claude Code is definitely a harness. The term harness is pretty loosely defined, but it effectively means the software that wraps an LLM, asks the LLM what tools it should execute, then executes those tools. I wouldn't classify Claude Code as a sandbox, though it does have some sandbox features built in, using https://github.com/anthropic-experimental/sandbox-runtime (which I would classify as a sandbox)

For small projects where I don't wish to interact with Claude so much, I've started using Anthropic's sandbox runtime utility "srt": https://github.com/anthropic-experimental/sandbox-runtime This is combined with "auto" mode. Seems to work so far. I've manually checked various things, rw access, access to sensitive folders/files etc. So far, I've only used it on two small projects. My major projects I've been clicking through prompts and recently switched to "auto" mode. I'm not quite sure why anyone would trust "--dangerously-skip-permissions". I've seen these agents go off-piste far too many times, installing unnecessary packages, environments, calling sudo & creating files in all sorts of places. There's a page on various sandboxing strategies on their site: https://code.claude.com/docs/en/sandbox-environments I've seen various comment

I've been satisfied with using Pi inside of srt [0]. I launch with `srt pi` and get file system and network isolation. There is a seemingly infinite risk surface area to protect, but I think does a reasonable job of balancing security and convenience. I've also heard good things about nono [1] from colleagues, but I haven't personally tried it out yet. [0] https://github.com/anthropic-experimental/sandbox-runtime [1] https://github.com/nolabs-ai/nono