Dokumentationerreichbar
Anthropic, Configure the sandboxed Bash tool
code.claude.com (externe Seite)
Die Herstellerdokumentation zur Sandbox, die jeden Bash-Befehl in eine vom Betriebssystem gezogene Grenze sperrt. Sie ist die Quelle für den Unterschied, um den es in diesem Kapitel geht: Eine Rechteregel entscheidet je Aufruf, diese Grenze gilt für den laufenden Prozess und alle seine Kinder. Zwei Stellen wiegen schwerer als die Beschreibung selbst. Erstens läuft die Sandbox voreingestellt fail-open: Fehlt ein Paket oder ist die Plattform nicht unterstützt, arbeitet Claude Code ohne Sandbox weiter, bis jemand sandbox.failIfUnavailable setzt. Zweitens darf das Modell die Grenze über einen Rückfallpfad selbst verlassen, wenn ein Befehl darin scheitert; der zweite Versuch läuft dann außerhalb, und wer ihn genehmigt, richtet sich nach dem Rechtemodus. Auf mac
geprüft 10.11.2026
Worauf sich diese Seite beruft, wörtlich, abgerufen am 06.11.2026:
In a Linux session with CLAUDE_CODE_SUBPROCESS_ENV_SCRUB set, every command runs sandboxed, so excluded commands and commands you type are refused too.
bestätigt 10.11.2026Unless managed settings set them, a developer’s user settings or --settings can turn on the following keys.
bestätigt 10.11.2026The operating system enforces the sandbox boundary on the running process, so it holds regardless of what the model chose to run and even if an allowed command does more than its name suggests.
bestätigt 10.11.2026In both, the sandbox enforces the same filesystem and network restrictions; the difference is only in whether sandboxed commands are auto-approved or require explicit permission.
bestätigt 10.11.2026code running inside the sandbox can potentially use domain fronting or similar techniques to reach hosts outside the allowlist
bestätigt 10.11.2026Auto-allow mode works independently of your permission mode setting, with three exceptions: plan mode, an auto mode command that carries per-command allowed domains, and server-side classifier review of sandboxed commands in auto mode.
bestätigt 10.11.2026A command that carries hosts goes to the classifier instead of being approved by a permission rule or the sandbox's auto-allow mode.
bestätigt 10.11.2026You set which files and network domains those commands can reach, and the limits apply to Bash, Power
bestätigt 10.11.2026Shell, and Monitor commands and the processes they start. By default, when the platform doesn’t support the sandbox or the dependency check at startup fails, Claude Code runs commands without sandboxing.
bestätigt 10.11.2026The retried command runs unsandboxed. In an interactive terminal session, who approves it depends on your permission mode:
bestätigt 10.11.2026The sandbox is off by default.
bestätigt 10.11.2026To turn it on, run /
bestätigt 10.11.2026sandbox in a session Claude’s file tools, MCP servers, and hooks run outside it
bestätigt 10.11.2026What you type at the ! prompt usually runs outside the sandbox, so typing a line yourself doesn’t test it.
bestätigt 10.11.2026Most of the machine, including credential files such as ~/.ssh and ~/.aws/
bestätigt 10.11.2026credentials Inherited from Claude Code, including any secrets in its environment
bestätigt 10.11.2026The sandbox.credentials setting declares credential files and environment variables to protect from sandboxed commands.
bestätigt 10.11.2026environment variables are unset before each sandboxed command runs
bestätigt 10.11.2026There is no built-in credential deny list, so only the files and variables you list are restricted.
bestätigt 10.11.2026no scope can remove one that another scope added
bestätigt 10.11.2026sandbox.credentials affects sandboxed Bash commands only.
bestätigt 10.11.2026Claude Code shows sandboxed commands a per-session placeholder called the sentinel
bestätigt 10.11.2026the command still sees only the sentinel, but the sentinel reaches the server unchanged and authentication fails
bestätigt 10.11.2026It ignores them in a repository’s .claude/settings.json or .claude/settings.local.json
bestätigt 10.11.2026Masking files requires Claude Code v2.1.221 or later.
bestätigt 10.11.2026For files on mac
bestätigt 10.11.2026OS, Claude Code blocks the file instead of masking it. and tools that use UDP behave this way
bestätigt 10.11.2026docker is incompatible with the sandbox.
bestätigt 10.11.2026Connections go through a proxy on your machine that checks each host against your allowed domains, which start empty.
bestätigt 10.11.2026so a tool that opens its own connection fails
bestätigt 10.11.2026fail for the reason the database client entry gives
bestätigt 10.11.2026against an SSH remote fail inside the sandbox even when the host is allowed
bestätigt 10.11.2026By default, a sandboxed command can’t connect directly to a server that’s running on your machine outside the sandbox, such as a dev server or a database in a container.
bestätigt 10.11.2026Use it for a tool that can’t work inside the sandbox and that you trust with your full access.
bestätigt 10.11.2026An excluded command runs with your full access.
bestätigt 10.11.2026An excluded command goes through the regular permission flow
bestätigt 10.11.2026For example, allowing access to /var/run/docker.sock effectively grants access to the host system through the Docker socket.
bestätigt 10.11.2026Sandboxing reduces risk but is not a complete isolation boundary.
bestätigt 10.11.2026Each one weakens the sandbox, so set it to false in managed settings if you don’t want it used
bestätigt 10.11.2026If you set allowNestedUserNamespaces to true, you turn off a security boundary: code from a sandboxed command can end up running outside the sandbox.
bestätigt 10.11.2026sandboxed commands can then launch other applications unsandboxed with no user prompt
bestätigt 10.11.2026the setting exposes process information to sandboxed commands that a fresh /
bestätigt 10.11.2026proc mount would hide Requires Claude Code v2.1.305 or later.
bestätigt 10.11.2026still force a prompt even for sandboxed commands
bestätigt 10.11.2026Some sandboxed commands also go through the regular permission flow instead of being approved automatically.
bestätigt 10.11.2026Monitor tool commands aren’t approved automatically, though they still run in the sandbox.
bestätigt 10.11.2026Until you lift the restriction, commands run without the sandbox under the regular permission flow
bestätigt 10.11.2026To make Claude Code exit at startup instead, set sandbox.failIfUnavailable to true.
bestätigt 10.11.2026The session keeps running, and the refused command doesn’t run unsandboxed
bestätigt 10.11.2026Excluded commands and commands you type yourself keep running
bestätigt 10.11.2026In a background session, they’re refused too
bestätigt 10.11.2026to be prompted on Bash retries
bestätigt 10.11.2026which opens every Unix socket to sandboxed commands
bestätigt 10.11.2026connect to any port on localhost, which includes every other service listening there
bestätigt 10.11.2026set enableWeakerNetworkIsolation to true instead
bestätigt 10.11.2026A repository’s .claude/settings.json can too, unless the sandbox is admin-required.
bestätigt 10.11.2026Built-in file and web tools: tools such as Read, Edit, Write, Web
bestätigt 10.11.2026Fetch, and Web Search follow permission rules instead. command hooks, local MCP servers, plugin monitors, LSP servers, and helper commands such as your status line command and apiKeyHelper run with your full access
bestätigt 10.11.2026In bypass
bestätigt 10.11.2026Permissions mode, hosts outside your allowed domains are allowed unless one of them is on. A connection to a host in denied
bestätigt 10.11.2026Domains is refused in every permission mode too. Allowing broad domains such as github.com can create paths for data exfiltration.
bestätigt 10.11.2026Because the proxy makes its allow decision from the client-supplied hostname without inspecting TLS
bestätigt 10.11.2026configure a custom proxy that terminates TLS and inspects traffic, and install its CA certificate inside the sandbox
bestätigt 10.11.2026Claude can write that file and then run it outside the sandbox.
bestätigt 10.11.2026
Sandbox im Glossar01 Was Claude Code ist09 Sandbox und Isolierung11 Eine Wissensbasis aufbauen12 Rechner und Netz pflegen16 Rechte und Sandbox31 Der Harness