AI Potluck
Infrastructure / Deployment

sandbox-runtime

Anthropic

Open-source lightweight sandboxing tool from Anthropic that enforces filesystem and network restrictions on arbitrary processes at the OS level (Linux bubblewrap, macOS seatbelt) without requiring a container. Picked because it powers the bash tool sandbox inside Claude Code and is the reference design for safe local agent execution. ~4.1k stars and active development (63 commits in 90d).

anthropic-experimental/sandbox-runtime (npm @anthropic-ai/sandbox-runtime), v0.0.53 released 4 Jun 2026. Lightweight OS-level sandbox (Linux bubblewrap + macOS sandbox-exec/Seatbelt) enforcing filesystem + network restrictions on arbitrary processes WITHOUT a container; used to sandbox the Claude Code bash tool. Research preview. Verified live on GitHub June 2026.

Openness

5 high confidence
5.0
license
Apache-2.0(OSI)
source
public(GitHub)
distribution
npm package
core-gated
ungated

Apache-2.0 OS-level sandboxing library, fully open and self-contained; no feature-gated core or paid tier.

Adoption

2 medium confidence
2.0

npm @anthropic-ai/sandbox-runtime ~558.8k downloads in the last 30 days (npm registry API), plus 403 GitHub dependents and 4.3k stars. Package-manager pulls overstate distinct users (CI/mirror inflation) and it is a young research preview shipped alongside Claude Code, so reach placed conservatively at 10K-100K distinct users / level 2.

Capability

3 medium confidence
3.0

Best-in-class for low-overhead, no-container process isolation with fine-grained fs+network allow/deny and pre-built seccomp filters; but a process-level sandbox is a weaker security boundary than the microVM/gVisor frontier and offers no managed scale, so 3.

Unchanged since 2026-07-30 (last edited, not re-checked)