{"name":"sandbox","slug":"sandbox","family":"setting","title":"Settings keys","noun":"settings key","description":"[Isolate Bash commands](\/docs\/en\/sandboxing) from your filesystem and network on macOS, Linux, and WSL2","description_source":"docs","described_by":{"doc":"claude-code\/settings-reference","title":"All settings"},"presence":{"first_seen":"2.1.138","removed_in":"2.1.302","in_current_build":false,"newest_mined":"2.1.308","builds":127,"mined_builds":149,"first_cited":null},"aliases":[],"entries":[{"version":"2.1.305","anchor":"device-tool-refusal-text-adds-sandboxallownestedusernamespa","heading":"Device-tool refusal now names the nested user namespaces sandbox setting","line":"The message about device tools being withheld now lists `sandbox.allowNestedUserNamespaces` among the settings that weaken isolation","released_at":"2026-10-20 19:29:36","reason":"found in this entry's text"},{"version":"2.1.301","anchor":"settings-validation-sandboxcredentials-warnings-now-handle","heading":"Sandbox credential settings errors are now checked separately","line":"Problems in sandbox and sandbox.credentials settings, including warnings, are now judged by their own check for whether they stop settings from loading","released_at":"2026-10-15 14:34:23","reason":"found in this entry's text"},{"version":"2.1.300","anchor":"remote-control-rejects-sandbox-no-sandbox-instead-of-acc","heading":"claude remote-control now rejects --sandbox and --no-sandbox","line":"Passing --sandbox or --no-sandbox to claude remote-control is now an error instead of being silently accepted","released_at":"2026-10-14 14:27:26","reason":"found in this entry's text"},{"version":"2.1.300","anchor":"bridge-sandbox-option-no-longer-defaults-to-false","heading":"Remote sessions no longer force sandbox off when it is not set","line":"In Remote Control start-up settings, leaving `sandbox` unset no longer means off, so another default can apply","released_at":"2026-10-14 14:27:26","reason":"found in this entry's text"},{"version":"2.1.293","anchor":"new-monitor-watch-closed-event-name-and-a-new-mcp-app-sand","heading":"Fixed sandbox host for MCP apps and a new monitor event name","line":"Claude Code now names a fixed host, sandbox.claudemcpcontent.com, for MCP app sandboxes, and adds a monitor_watch_closed event name","released_at":"2026-10-07 17:18:04","reason":"found in this entry's text"},{"version":"2.1.286","anchor":"cloud-sandbox-refusal-reasons-expanded-seccomp-unavailable","heading":"More sandbox settings now block serving device tools remotely","line":"Claude Code now refuses to serve device tools when seccomp is unavailable or more sandbox-weakening settings are on","released_at":"2026-09-30 17:14:38","reason":"found in this entry's text"},{"version":"2.1.283","anchor":"invalid-sandbox-settings-now-validated-per-field-keeping-re","heading":"A bad sandbox setting no longer switches off the whole sandbox block","line":"Invalid sandbox settings are now handled one field at a time, falling back to the restrictive value instead of the whole block being ignored","released_at":"2026-09-25 18:46:11","reason":"found in this entry's text"},{"version":"2.1.282","anchor":"managed-settings-invalid-lock-values-and-nested-permission","heading":"Broken managed settings now fail safe, including permission and sandbox blocks","line":"An invalid value in managed settings now becomes its most restrictive value, and a block with an unreadable deny rule loses its allow grants","released_at":"2026-09-24 15:56:22","reason":"found in this entry's text"},{"version":"2.1.281","anchor":"auto-mode-can-hold-locally-auto-allowed-shell-commands-for-a","heading":"Auto mode can hold locally auto-allowed shell commands for a server-side classifier","line":"In auto mode, shell commands allowed locally by sandbox or read-only rules can now be held for a server-side classifier to review","released_at":"2026-09-23 17:01:17","reason":"found in this entry's text"},{"version":"2.1.280","anchor":"bridge-headless-session-start-gains-structured-telemetry","heading":"Bridge (headless) session start gains structured telemetry","line":"Headless bridge sessions now emit structured start and thread-requeue telemetry","released_at":"2026-09-22 15:44:39","reason":"found in this entry's text"}],"entries_total":16,"docs":[{"source":"claude-code","path":"settings-reference","title":"All settings","documented":true},{"source":"api","path":"about-claude\/models\/optimizing-for-cost-and-intelligence","title":"optimizing-for-cost-and-intelligence","documented":false},{"source":"api","path":"agents-and-tools\/agent-skills\/claude-api-skill","title":"claude-api-skill","documented":false},{"source":"api","path":"agents-and-tools\/agent-skills\/enterprise","title":"enterprise","documented":false},{"source":"api","path":"agents-and-tools\/agent-skills\/overview","title":"PDF Processing","documented":false},{"source":"api","path":"agents-and-tools\/tool-use\/bash-tool","title":"bash-tool","documented":false},{"source":"api","path":"agents-and-tools\/tool-use\/browser-use-sdk","title":"browser-use-sdk","documented":false},{"source":"api","path":"agents-and-tools\/tool-use\/code-execution-tool","title":"code-execution-tool","documented":false},{"source":"api","path":"agents-and-tools\/tool-use\/computer-use-tool","title":"computer-use-tool","documented":false},{"source":"api","path":"agents-and-tools\/tool-use\/how-tool-use-works","title":"how-tool-use-works","documented":false}],"docs_total":13,"gates":[],"related":[],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/sandbox","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}