Anthropic's documentation lists six ways to isolate Claude Code: the sandboxed Bash tool, the sandbox runtime, a dev container, a custom container, a virtual machine, and a cloud session. Pick by threat model. Everyday work suits the Bash sandbox. Unattended runs need a boundary around the whole process. Untrusted repositories call for a VM or a cloud session.
The six options
| Approach | What is isolated | Docker needed | Setup effort |
|---|---|---|---|
| Sandboxed Bash tool | Shell commands and their child processes | No | Minimal on macOS, low on Linux and WSL2 |
| Sandbox runtime | The whole Claude Code process, including file tools, MCP servers, and hooks | No | Low |
| Dev container | Full development environment | Yes | Medium |
| Custom container | Full development environment | Yes | Medium to high |
| Virtual machine | Full operating system | No | High |
| Cloud session | Full operating system, hosted by Anthropic | No | None, but needs a subscription |
The first two run on the host operating system without containers. The rest place Claude Code inside a container or virtual machine. The sandbox runtime is described as a beta research preview whose configuration format may change.
What the Bash sandbox does not cover
The built-in Bash sandbox restricts shell commands. The documentation states that Claude's file tools, MCP servers, and hooks run outside it. Built-in tools such as Read, Edit, and WebFetch follow permission rules instead. If your concern includes MCP servers or hooks, the Bash sandbox alone is not enough, and the documentation points to running the whole process inside the sandbox runtime, a dev container, or a custom container.
Match your goal to an option
| You want to | Start with |
|---|---|
| Reduce permission prompts on your own machine | The sandboxed Bash tool |
| Work unattended with prompts skipped | A container, a VM, or the sandbox runtime |
| Isolate MCP servers and hooks without Docker | The sandbox runtime |
| Work on an untrusted repository | A dedicated VM, or a cloud session |
| Standardize a team environment | A dev container copied into the repository |
| Use Claude Code from a device with no local setup | A cloud session |
| Work on native Windows | A container or VM, or WSL2 for the Bash sandbox |
Worked example: three developers, three choices
An illustrative scenario.
Priya works on a trusted internal service on a Mac. She turns on the Bash sandbox in auto-allow mode so routine commands stop prompting. Her network allowlist starts empty and she adds the registries she uses. She keeps MCP servers off because the sandbox does not cover them.
Marcus runs agents overnight to chase flaky tests. Because he lets them run with permission prompts skipped, he uses the preconfigured dev container with its default deny firewall. The documentation says that with no prompts to catch mistakes, the isolation boundary protects your system, and that such sessions should run inside a container, VM, or the sandbox runtime.
Elena reviews contributions from outside the company. She does not want any of that code on her laptop, so she uses a cloud session, with a network level set to Custom.
Each chose the boundary that matches how much she trusts the code and how much supervision there is.
Layering is allowed
The documentation says you can layer approaches. Running the sandboxed Bash tool inside a container or VM gives OS level command restrictions on top of the outer boundary. That is a reasonable pattern for unattended work on code you partly trust.
Warnings worth repeating
- Isolation reduces the impact of a breach but does not eliminate risk. Any approach that allows network egress can still leak data the agent can read, and any approach that mounts the project writable can still modify that code.
- Isolation does not change what is sent to the model. Prompts and files Claude reads go to the API or your configured provider with or without a sandbox.
- The unsandboxed retry escape hatch lets a command that fails in the sandbox ask to run outside it. You can disable it with the allowUnsandboxedCommands setting set to false.
Steps to decide for a team
- List the tasks: exploration, unattended runs, untrusted code, team standard.
- Rate how much supervision each gets.
- Choose the minimum boundary that covers the process and the risk, using the table above.
- Decide whether to enforce it. Only the built-in Bash sandbox is enforced by Claude Code through managed settings. Containers and VMs are conventions unless you enforce them with device management or software allowlisting.
- Test the boundary: ask the agent to read a file outside the project and reach a host outside the allowlist.
- Record the choice and review it when tasks change.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how an assistant is connected to a security tool and what it can ask for, which is the access an isolation boundary has to contain.
Where Safeguard fits
Safeguard does not provide these isolation options. It can connect to Claude and other assistants, and its MCP Guardrail, agent identity, and policies and gates apply to what an agent does. Its CLI is a single static binary that you can run in a pipeline or terminal. It can write code as well as scan.
Quick check
Is the Bash sandbox enough for unattended runs?
The documentation says it is not sufficient on its own for fully unattended runs, since it constrains only shell commands. Put the whole process inside a container, VM, or the sandbox runtime.
Do containers and VMs get enforced by Claude Code?
No. Claude Code does not require a container, so enforcement comes from your device management or software allowlisting. Only the built-in Bash sandbox is enforceable through managed settings.
Does a sandbox stop prompts and files going to the model?
No. Isolation limits local reach, while prompts and files Claude reads are still sent to the API or your provider.
Sources
- Choose a sandbox environment (Anthropic documentation)
- Configure the sandboxed Bash tool (Anthropic documentation)
- Use Claude Code in the cloud (Anthropic documentation)
- Safeguard download page
Last reviewed: 19 October 2026.
