2026-10-28 · America/Los_Angeles · 社区动态 · #16

Everyone says "sandbox your agent." Claude Code's sandbox is off by default

The Qwen3.8-Flash-Next threads keep ending on "sandbox your agent," and a top reply asked how. Nobody posted settings, so we read the docs for the tools most of you run. Commands are on the card. Claude Code ships with the sandbox off. Turn it on with /sandbox or sandbox.enabled. Network then goes through a local proxy whose domain allowlist starts empty. Set sandbox.failIfUnavailable to true. Without it, a sandbox that can't start (on Linux it needs bubblewrap and socat) means your commands run unsandboxed. Native Windows has no sandbox, so use WSL2. Codex CLI keeps network off in…

热度 45.4 / 100；排名与评分保留该期记录。