Anthropic sandbox-runtime: verify the boundary before running an agent

Follow the official repository's platform prerequisites. The macOS path uses the system sandbox; Linux depends on tools including bubblewrap and socat. Windows has a separate alpha implementation and setup path. Do not apply these POSIX examples as a Windows installation recipe.

Install the package only after reviewing those requirements:

npm install -g @anthropic-ai/sandbox-runtime
srt --help

Keep the installed runtime outside directories the sandboxed command may write. On a managed Linux host, stop if user-namespace or security policy blocks the prerequisites; do not disable machine-wide protections to force a demo to run. Use an approved disposable environment instead.

In a new empty demo directory, create private and output folders. Put the text “synthetic fixture” in private/fixture.txt. Create sandbox.json alongside those folders:

{
  "network": { "allowedDomains": [] },
  "filesystem": {
    "denyRead": ["./private"],
    "allowWrite": ["./output"],
    "denyWrite": []
  }
}

The filesystem documentation says reads are allowed by default unless denied, while writes use an allowlist with documented runtime exceptions. This example does not hide every other readable file on your machine. Keep real secrets out of the test environment. Use existing literal paths for this first trial; platform glob semantics differ.

Run from that demo directory in a POSIX shell. These are expected outcomes to verify on your host, not captured test results:

# Expected: creates output/result.txt
srt --settings ./sandbox.json "printf 'ok' > output/result.txt"

# Expected: cannot reveal the fixture content
srt --settings ./sandbox.json "cat private/fixture.txt"

# Expected: cannot create a file outside the write allowlist
srt --settings ./sandbox.json "printf 'blocked' > outside.txt"

# If curl is installed, expected: external access is blocked
srt --settings ./sandbox.json "curl --max-time 10 https://example.com"

Inspect the filesystem from outside the sandbox: the permitted output should exist, outside.txt should not, and the private fixture should be unchanged. Read the process output and status as well. A missing command or DNS failure is not by itself proof that the intended sandbox rule worked; identify the actual reason. CLI settings and network controls are documented in the README.

List what the real command needs: input files, output directory, subprocesses and network hosts. Build a new policy for that task instead of treating this fixture policy as production-ready. Install dependencies outside the sandbox first where appropriate; downloading packages during a task introduces additional network and execution requirements.

Keep the policy and runtime outside writable output. Re-run denial checks after changing permissions. If a workflow fails, identify the missing access before widening it. Do not replace a narrow allowlist with unrestricted network and filesystem access simply to obtain a green run.

For a local MCP server, follow the project's documented wrapping approach only after understanding its files, ports and child processes. A reusable skill can describe the procedure, but cannot replace OS enforcement.

The repository describes the runtime as a beta research preview and documents platform-specific limitations. Review those limitations and the current release before trusting a new environment. Project status and implementation

A sandboxed command can still damage data you deliberately made writable or send allowed data to an allowed destination. It can also produce a wrong answer. Keep human approval for consequential operations and verify the result independently. A passing four-case demo proves those cases on that host, not universal containment against every program.

The project is Apache-2.0-licensed. Local execution still uses your machine or hosting resources, and any connected model or external service can charge separately. Installing this runtime does not include an agent subscription or API allowance. License and project documentation

Record the host, runtime version, policy and observed outcomes. The first exercise is complete when you can explain each allowed or denied action and inspect the resulting files. If a denial cannot be explained, leave the result unverified and resolve that layer before giving it real work.