Configure the sandboxed Bash tool changedsandboxing
Nearest release: v2.1.312, published under an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 27 Oct 2026 19:24 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 27 Oct 2026 19:37 UTC.
Upstream edited
Recorded here
Lines+2added
Lines−1removed
From line
316
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits56to this page, all time
The whole hunk
from line 316, old and new numbered
/
from line 316
316316* **Every command in the call has to match**: `npm ci && docker compose build` stays sandboxed unless another entry covers `npm ci`
317317* **Claude Code matches the text of the call**: a script or `make` target that calls `docker` internally doesn't match, and neither does `/usr/local/bin/docker`
318318* **Some calls stay sandboxed**: a redirect to a file, a `cd`, or a command substitution such as `$(...)` keeps the whole call sandboxed. The [reference entry](https://code.claude.com/docs/en/settings-reference.md#sandbox-excludedcommands) lists more calls that stay sandboxed
319* **A `git clone` needs relative paths**: your entry doesn't cover a clone that names an absolute path, a path starting with `~`, or one with a `..` segment. If the clone can go inside your working directory, ask Claude to use a relative path with no `..` segment, such as `vendor/lib`
319320* **Where you save the entry can matter**: while the sandbox is [admin-required](#repository-settings-under-an-admin-required-sandbox), Claude Code ignores entries in `.claude/settings.json` and `.claude/settings.local.json`
320321
321322An excluded command goes through the regular permission flow:
from line 351
350351
351352The sandbox has two independent layers: [filesystem isolation](#filesystem-isolation) controls which paths sandboxed commands can read and write, and [network isolation](#network-isolation) controls which domains they can reach. With the filesystem layer off, sandboxed commands get unrestricted read and write access to the host filesystem, while their network egress stays confined to your allowed domains. Turn the layer off when you sandbox to control where commands connect rather than what they write.
352353
353`sandbox.filesystem.disabled` defaults to `false`. Requires Claude Code v2.1.216 or later.
354`sandbox.filesystem.disabled` defaults to `false`.
354355
355356> [!WARNING]
356357>
No line in this hunk matches that.