Class 13 · 13.2

The native sandbox — /sandbox

The simplest of the three: a sandbox that lives inside Claude Code and runs on your own machine. One command — /sandbox — and Claude stops asking permission for the safe stuff.

🎯 Goal: run a safe local sandbox⏱ Read: 14 min🤖 Type: hands-on

You met the idea of a sandbox in 13.1. Now the first, easiest way to get one: it is already built into Claude Code. Nothing to install, nothing in the cloud — just a command.

01What it is (and why it beats Docker)

The native sandbox behaves like running your own Docker container — a box within a box — but it is implemented at the operating-system level, which makes it dramatically more lightweight. It spins up instantly, uses almost no overhead, and gets out of your way.

Same protection, far less weight. No image to build, no runtime to boot — the OS itself does the fencing.

You may recognise the pattern: Cursor has a similar built-in sandbox that auto-approves actions inside its box. Claude Code’s version lives right in the CLI.

02Turning it on: `/sandbox`

Inside Claude Code, type the command. On first run it says “sandbox disabled — press enter to configure”. Claude is smart enough to know what needs installing and will walk you through it.

Run `/sandbox`

It shows your current setting (“no sandbox”) and offers to configure.

Pick a mode

You get two real modes (see below). Choose option 1 for the sandboxed-YOLO experience.

Review Overrides & Config

Overrides = what happens on a fall-back (drop out of the sandbox, or be strict). Config = the explicit allow / deny lists.

Mode	What it does	Feels like
1 · recommended	Commands try to run in the sandbox automatically; anything that must reach outside falls back to normal permissions. Explicit deny rules are always respected.	Sandboxed YOLO
2	Allows bash / shell scripts to run, but keeps regular permission prompts.	Cautious
0	No sandbox (the old default).	Manual

claude

> /sandbox
  Sandbox disabled. Press enter to configure…

  # choose:
  1) Sandboxed — auto-approve inside the box, fall back outside   ← pick this
  2) Allow bash + regular permissions
  0) No sandbox

  Sandbox mode is now ON.
  # Config shows sensible deny rules already in place — good.

There is a link to the docs right there

Every screen carries a link to the sandbox documentation. When you want fine-grained control — say, allowing web access to specific sites only — that is where the detail lives.

03What runs free vs. what still asks

no prompt

Runs freely in the box

Running bash / shell scripts, and reading & writing files to its heart’s content — all auto-approved.

still asks once

Reaching outside

Web searches still prompt (once). Approve it and Claude carries on. Anything trying to leave the box is where the fence does its job.

04A demo: research three docs, hands-off

With the sandbox on, the instructor fires off a real task and then simply… watches. Notice how little it needs to ask:

claude — sandbox on

> Please carry out comprehensive research and write three documents
  to the planning directory:
   1. the market-data API from Massive (formerly Polygon)
   2. how we would build our market-data interface
   3. how we would build a market-data simulator

# It researches, thinks, reads & writes files — no permission prompts.
# It only pauses to ask about a web tool (Context7) it had not used before.
Done. 3 documents created in planning/.

Trust the flow this week

The instructor did not review the documents line-by-line — the whole point is to be more trusting once the box makes it safe. You review the important output (the PR), not every keystroke.

05The Windows / WSL catch

Read this if you are on Windows

On Mac (and Linux) the native sandbox is effortless. On Windows, as of now, it requires WSL (Windows Subsystem for Linux — running a Linux machine inside your PC). If you already use WSL, great. If you do not, skip this approach for now and use the other two (Purple & Yellow) — they work everywhere. Native Windows support without WSL is on the roadmap and may already be live by the time you read this.

06Security & the docs

If you are going to lean on the native sandbox a lot, spend ten minutes in the documentation. It covers two things worth knowing:

Granular config — e.g. allowing web access to a specific set of sites rather than none or all.
Security considerations — the real caveats of running auto-approved commands, laid out clearly. A sandbox reduces risk; it does not make you invincible.

✓ Key takeaways

/sandbox gives you a fast, OS-level box built into Claude Code — lighter than Docker.
Mode 1 is sandboxed-YOLO: auto-approve inside, fall back outside, deny-rules always honoured.
Files & bash run free; web search still asks once.
Mac/Linux: effortless. Windows needs WSL for now — otherwise use the cloud approaches.
Read the docs for granular allow-lists and the real security caveats.