What
The sandbox setting allowAllUnixSockets lets sandboxed commands use any Unix socket, a channel programs on the same machine use to talk to each other. Its description now adds that on Linux it also unblocks VM sockets (AF_VSOCK), which let a virtual machine talk to the machine hosting it.
Why
Turning this setting on opens more than its name suggests on Linux, so weigh that before enabling it.
Names in the bundleallowAllUnixSockets
Documented inclaude-code/agent-sdk/python
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up allowAllUnixSockets, on Configure the sandboxed Bash tool.
* `unshare -U true` prints `unshare: unshare failed: Operation not permitted`. With [`allowAllUnixSockets`](/docs/en/settings-reference#sandbox-network-allowallunixsockets) on, it can print `No space left on device` insteadsandboxing see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up allowAllUnixSockets, on Configure the sandboxed Bash tool.