DiamondLightSource Releases Open-Source Sandbox for Coding Agents

DiamondLightSource has released claude-sandbox, an open-source tool that ensures the autonomy of coding agents while blocking security risks. Distributed under the Apache 2.0 license, it supports Claude Code, Codex, Pi, and others.

Key Features and Security Architecture

• bubblewrap (bwrap) Isolation: Runs agents in a jail with a default-deny home directory, allowing access only to permitted paths.
• Network Blocking: Blocks local network access by default to prevent internal host detection during prompt injection attacks. Access to model APIs and Git forges is allowed.
• Browser Automation Support: Enables web UI testing by running Playwright and headless Chromium within the jail.
• Token Scoping: Manages GitHub/GitLab tokens by restricting them to the container scope.

Development Process and Validation

The project was largely written by Claude Code, with architectural decisions documented through Architecture Decision Records (ADRs). Security vulnerabilities were addressed through a 21-item validation checklist and adversarial escape attempts, including attempts to escape via /proc/<pid>/root. The structure adopts a design where the agent validates and protects its own jail.