Anthropic Sandbox Runtime vs Sandlock

Anthropic Sandbox Runtime (srt) is a free, open-source research preview that applies filesystem and network restrictions to processes at the operating-system level, without requiring a container. It can be used as a CLI tool or library to sandbox agents, local MCP servers, bash commands and other processes. Filesystem writes and network access are denied by default, with configuration options to allow paths and domains. The project documents macOS, Linux and Windows support, using sandbox-exec, bubblewrap or a dedicated local sandbox account with Windows Filtering Platform and filesystem ACLs, respectively. Windows is marked alpha. Install it from npm with `npm install -g @anthropic-ai/sandbox-runtime`. Linux requires bubblewrap, socat and ripgrep; macOS requires ripgrep, and Windows needs a one-time elevated setup step. On macOS, srt can provide real-time alerts from the system sandbox violation log. Linux bubblewrap has no built-in violation reporting, and Linux network filtering relies on proxy environment variables, which some programs may ignore. The preview is developed for Claude Code; its APIs and configuration formats may evolve.

Sandlock is a Linux process sandbox for confining untrusted code with policies enforced by the kernel. It uses Landlock, seccomp-bpf, and seccomp user notification to control filesystem access, network activity, system calls, and resource use. Policies can deny network egress by default, apply HTTP method, host, and path rules, stage writes through copy-on-write, and set resource limits. A supervisor can attach credentials through a proxy after an HTTP access check, keeping the secret value out of the sandboxed workload. Interfaces include a CLI, Python SDK, Rust API, Go SDK, OCI runtime, and MCP server. The OCI runtime works with containerd, CRI-O, and Kubernetes, while the remote MCP API can connect to Claude Desktop, Cursor, or another MCP client. Sandlock runs as an ordinary user without root, a container runtime, or a hypervisor. Linux 6.12 or later supports the full protection set by default; older kernels require explicit waivers for missing protections. It shares the host kernel, excluding kernel vulnerabilities and hardware side channels from its guarantees.