Choose a sandbox environment changedsandbox-environments
Nearest release: v2.1.236, published 3 hours after this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+2added
Lines−2removed
From line
157
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits18to this page, all time
The whole hunk
from line 157, old and new numbered
/
from line 157
157157
158158## Enforce isolation across an organization
159159
160Individual developers can opt into any approach above. What an organization can enforce, and with which tools, depends on the approach:
160Individual developers can opt into any of the sandboxing approaches on this page. What an organization can enforce, and with which tools, depends on the approach:
161161
162162* **Built-in Bash sandbox**: the only approach Claude Code enforces itself. Deliver the `sandbox` settings keys through [managed settings](/docs/en/settings#settings-files), either as a file managed by your MDM or through [server-managed settings](/docs/en/server-managed-settings) on Claude.ai. See [Enforce sandboxing with managed settings](/docs/en/sandboxing#enforce-sandboxing-with-managed-settings) for the keys to deploy and how to keep developers from widening the policy.
163163* **Dev containers**: commit the [example dev container](/docs/en/devcontainer) to your repositories to standardize the environment across a team. This is a convention rather than an enforcement boundary, because Claude Code does not require a container. If developers should not be able to run Claude Code outside it, enforce that with your organization's device management or software allowlisting tools.
from line 165
165165
166166## See also
167167
168These pages cover configuration and policy details for the approaches above.
168These pages cover configuration and policy details for the sandboxing approaches on this page.
169169
170170* [Sandboxing](/docs/en/sandboxing): configure the built-in sandboxed Bash tool
171171* [Dev container](/docs/en/devcontainer): the preconfigured Docker development container
No line in this hunk matches that.