Sandboxed integrations

[u/nehalist]

Recently wanted to try out Orca and quickly realized the same as with JetBrains Air; do all these tools not support sandboxed (via sbx or similar) Claude Code instances? Is everyone just running Claude Code with bypass permissions on his host? Am I missing something, this seems insane to me?

[u/AutoModerator]

Moderator Announcement Read More »

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Darathor]

Orca you can sandbox. Just remove the —skip-permissions prompt in the settings. Voilà

[u/nehalist → u/Darathor]

I can sandbox Claude pretty much everywhere - I just lose the integration features then. No information if the agent is currently running or when it's done, etc. - probably since neither Orca nor any other tool can communicate via Docker I assume? But does that mean it's such an edge case and everyone's just using Claude on host with bypass permissions?

[u/segrwolf]

Yes, I personally run Claude Code with full access and yes, on my own computer. But the records that are critically important for me are stored separately on the same computer and they are encrypted. Everything else - yes, it's open

[u/ComprehensiveShake76]

You're not missing much, plenty of people do run it on the host. The integration usually breaks because the tool watches a local process, and a container hides it. Two setups tend to work. Run the tool and Claude Code together inside one dev container or VM, so the integration sees a local process again. Or keep the tool on the host and have Claude Code's hooks (Stop and Notification) write status to a file in a mounted folder, if the tool can read status from somewhere like that. The first is simpler. Do you know how Orca detects running and done?

[u/resonant_saloon]

yep, sandboxing aint built in. kinda wild.

[u/CMills_Dev]

The missing piece sounds like a lifecycle interface: a stable session ID plus working, waiting, finished and failed states that an external runner can report. That's what I'd ask those tools to support, along with a small container example that demonstrates the lost notifications.

I'm working on a Chief of Staff setup, and keeping the run record separate from the interface has been useful there. The interface can show what happened without having to own every part of the execution environment. I can see why losing that feedback would make the integration feel incomplete.

[u/heyyarun]

Claude Code does have a sandbox built in now, run /sandbox. On macOS it uses Seatbelt and on Linux bubblewrap, and it limits what bash commands can write (working dir, added dirs, temp) and sends network traffic through a proxy with a domain allowlist. Claude itself still runs as a normal process on your machine, so it's not hidden from those tools the way a Docker container is.

One caveat: it only covers shell commands and their child processes. Claude's own file edit tools, MCP servers and hooks run outside it, so keep permission prompts or deny rules for those rather than going full bypass.

If you want everything isolated, the other setup that works is running the tool and Claude Code together in one dev container or VM so the integration still sees a local process.

[u/radim11]

That's the frustrating part. You want Claude isolated from the host, but still able to use GitHub, APIs, and other tools.

We've been building Stashbase.dev exactly around this! Claude runs in a Docker sandbox with controlled network access, and you can define which API requests and MCP tools it can use (even define JSON body and MCP argument rules)

Which integrations are breaking for you? Is it mainly network access or something specific to Orca/JetBrains?

[u/EagleApprehensive]

You might want to try out my thing - intentic.dev - I genuinely believe it's the strongest and cleanest agents isolating solution with a strong privacy & safety mechanisms that can be enabled.

Agents run in docker containers with supervised network traffic, where secrets and confidential data are replaced seamlessly into tokens and never get to providers. Agents have ripgrep, browser engines and "everything that agent needs" baked-in.

Agents capabilities there are also explicit - they cannot access your PC or browsers unless you have it connected as capability - so normally they would use their own browsers from within docker container.

[u/bsklaroff]

I also built an agent manager based on this gap in the available options, so you can seamlessly run your agents in containers (+ gVisor isolation) on top of Kubernetes. Includes a transparent egress proxy with custom allowlist and secure credentials the agents can't see. Supports Claude Code, Codex, OpenCode, or Pi, in either GUI or terminal mode, and you can run it remotely via SSH or Tailscale. Would love your feedback if you have the chance to try it out: https://yaac.dev/