Claude Code's Sandbox Is Now Open Source: Seatbelt for macOS, Bubblewrap for Linux, Containers Are No Longer a Must

Anthropic has independently open-sourced the OS-level sandbox underpinning Claude Code. The project is named sandbox-runtime, shortened to srt. As clearly laid out in MarkTechPost's coverage, it restricts file and network access for AI agents, MCP servers and CLI tools, runs on Seatbelt for macOS and bubblewrap for Linux, and does not require containers at all.

This release is well worth attention, as the permission scope of local AI tools is growing rapidly. Previously you only asked models to answer questions, but now you let agents read code repositories, run commands, install dependencies, and connect to external services. Convenient as this evolution is, system permissions expand right along with these new capabilities. Most people have not carefully considered what resources a single MCP server or CLI command can touch. The logic behind srt is very direct: add an access gate at the operating system layer to draw clear boundaries for all file and network access.

"No containers required" is both its core selling point and its inherent boundary. Container isolation is heavier, offers a more fully isolated environment, but brings additional overhead when used on local development machines. The OS-level sandbox runs natively on the host system, is far lighter to launch and integrate, but has to be adapted separately to match the respective underlying mechanisms of macOS and Linux. Seatbelt and bubblewrap are not the same system, so their behavioral differences and policy details are subject to specific implementation. Do not treat it as a universal all-in-one security guarantee. It solves the permission restriction problem, but cannot audit every single step your agent takes on your behalf.

For developers, srt sits between AI agents and your local system. Tools like Claude Code need to execute commands, MCP servers need to access external resources, and CLI tools need to read and write local files. Putting all of them in the same restricted runtime is far more manageable than handling permission controls separately for each individual tool. For regular users, you can think of it as an access guard you install for your AI: it predefines which folders the AI can enter and which system resources it can access.

The project is already open sourced. Refer to the original article and the code repository for specific usage instructions and platform support details. Coverage source: MarkTechPost, written by Asif Razzaq.

Original article link: Meet Anthropic’s sandbox-runtime: OS-Level Sandboxing for AI Agents, No Containers