Claude Code v2.1.307 ·
Sandbox network exclusions now include private address ranges
The sandbox's default list of excluded network addresses now also covers common private and carrier address ranges
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.307,
ImprovementsSection of the release
Unclear Whether these addresses are now allowed to bypass the sandbox's network handling or are now blocked is not settled.
What
The sandbox's default list of excluded network addresses used to end at host.docker.internal. It now also includes:
10.0.0.0/8172.16.0.0/12192.168.0.0/16100.64.0.0/10
The first three are private ranges, the kind used inside home and office networks. The last is a range internet providers use for shared addresses.
Why
This changes how the sandbox's network handling treats addresses on internal networks.
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtWhether these addresses are now allowed to bypass the sandbox's network handling or are now blocked is not settled.
See this entry in the whole of v2.1.307 →
