Skip to content
Book a callSkip the hiring grind

Day 10 of 52 · about 20 min · Safety

Sandbox Bash and guard against prompt injection

Claude reads files, issues and web pages that other people wrote. The safest setup assumes one of them is trying to steer it, and limits what any single command can reach.

You’ll finish with

  • The Bash sandbox on, proven to block writes outside the project
  • Your SSH and cloud credential files out of reach of sandboxed commands
  • Three habits for text other people wrote

You’ll need

  • macOS, Linux or WSL2. On native Windows, Claude Code runs commands unsandboxed, so use WSL2
  • The Day 9 permission rules in your project
Start from the practice project as of Day 9 (.zip, 10 KB)

Before you start

Tell us about your setup and the steps change to fit it. Your answers stay in this browser, and you can change them at any time.

Which system are you on?

Commands differ between systems. Pick the one you’ll run Claude Code on.

The steps

One step at a time. When a step’s check matches, tick it and the next one opens.

0 of 4 steps done0%

  1. Step 1 of 4: Get your system ready

    Install what the sandbox needs on your system.

    For macOS

    Terminal

    What happens: Nothing to install. macOS has the sandbox framework built in.

    Skip to the next step.

    For Linux and WSL

    Terminal

    Run: sudo apt-get install bubblewrap socat

    What happens: On Fedora: sudo dnf install bubblewrap socat

    Ubuntu or Debian. The sandbox needs both packages.

    For Windows

    PowerShell

    What happens: Open your WSL2 distribution and follow the WSL steps.

    The sandbox runs on macOS, Linux and WSL2, not native Windows.

    Check it worked

    On Linux or WSL2, the install finishes without errors.

  2. Step 2 of 4: Turn the sandbox on

    Open the sandbox panel and pick auto-allow.
    In Claude Code

    You type: /sandbox

    What happens: A panel opens with Mode, Overrides and Config tabs.

    What happens: On the Mode tab, choose auto-allow.

    Auto-allow runs sandboxed commands without a prompt; the boundary does the guarding.

    Check it worked

    Claude Code saved your choice in .claude/settings.local.json for this project.

    If it didn’t work

    The panel shows only a Dependencies tab

    A package is missing. Install it, restart Claude Code and run /sandbox again.

  3. Step 3 of 4: Prove the boundary holds

    Ask Claude to write outside the project and watch it fail.

    Ask Claude to run the probe: commands you type after ! usually run outside the sandbox.

    Paste this into Claude Code
    Run this exact command and show me the result: touch ~/sandbox-probe
    In Claude Code

    You type: Run this exact command and show me the result: touch ~/sandbox-probe

    What happens: It fails with Operation not permitted on macOS, or Read-only file system on Linux and WSL2.

    What happens: If Claude offers to retry outside the sandbox, decline.

    By default, sandboxed commands write only to the project, a temp folder and folders you add.

    Check it worked

    The command failed, and there is no sandbox-probe file in your home folder.

    If it didn’t work

    The `touch` command worked

    Delete ~/sandbox-probe, then run /sandbox to check it is on with nothing missing.

  4. Step 4 of 4: Keep secrets out of reach

    Block credential files and treat outside text with care.

    Sandboxed commands can still read most of your machine, including ~/.ssh. Add this block to ~/.claude/settings.json, keeping existing keys. It also turns the sandbox on in every project. Your Day 9 Read deny rules already apply inside it.

    Changes to ~/.claude/settings.json

    Unchanged: {
    Added: "sandbox": {
    Added: "enabled": true,
    Added: "credentials": {
    Added: "files": [
    Added: { "path": "~/.aws/credentials", "mode": "deny" },
    Added: { "path": "~/.ssh", "mode": "deny" }
    Added: ]
    Added: }
    Added: }
    Unchanged: }
    A deny entry stops sandboxed commands reading that file or folder.
    • Read each command before you approve it.
    • Don’t pipe untrusted text straight into Claude.
    • Keep allowed network domains narrow. A broad one like github.com can carry data out.

    Check it worked

    In /sandbox, the Config tab shows the sandbox settings now in effect.

Finish · 4 of 4 steps to go

Commands run inside a boundary

Permission rules decide what Claude may try; the sandbox limits what a command can reach.

What you’ll have checked

  • /sandbox shows the sandbox on
  • touch ~/sandbox-probe failed when Claude ran it
  • Your credential files are on the deny list

Lesson updates by email

Get lesson updates by email

Leave your email and we’ll tell you when we add or update a lesson.

We’ll email you when we add or update a lesson. We use your email only for this. Privacy policy

Claude Code for your team

Want Claude Code set up across your team?

HorizonLux sets up and repairs Claude Code for teams: CLAUDE.md rules, hooks that enforce them and reviewed MCP servers. Book a free call to talk it through.

Book a free call Claude Code agency

Related

How we build

AI software factory

Questions

Questions about Day 10

Does the sandbox cover Claude’s file edits too?

No. It wraps shell commands and the processes they start. Read, Edit and WebFetch follow your permission rules, so you need both.

Sources

Checked against the official Claude Code docs on .

Independent resource, not affiliated with Anthropic. HorizonLux wrote this lesson; Claude Code is made by Anthropic.