How a Network less Agent Reaches a Model

Explanation. Agent containers have only a loopback interface. So how does Claude Code inside one talk to Ollama or vLLM?

Through a unix socket, not a network. Unix sockets are files. Connecting to one is local inter-process communication through the kernel, so it needs a reachable path, not a network interface.

1. The agent's 127.0.0.1 is its own. Every network namespace has a private loopback. Inside the sandbox, curl 127.0.0.1:11434 gets connection refused: nothing listens there, and the host's loopback is a different interface in a different namespace.
2. A relay listens on the agent's loopback. The entrypoint (agent-shim) starts socat TCP-LISTEN:4000,bind=127.0.0.1 → UNIX-CONNECT:/run/gw/llm.sock. Claude Code is configured with ANTHROPIC_BASE_URL=http://127.0.0.1:4000, so as far as it knows, it is talking to the Anthropic API.
3. The socket is bind-mounted, one per task. /run/gw inside the sandbox is the host directory $AGENTBOX_DATA/sockets/<id>/, and nothing else. That directory is mode 0711: the agent can connect to llm.sock by name but can't list anything, and it can't see other tasks' sockets.
4. The gateway is on the other end. It runs inside the agentbox container, which uses host networking. It accepts only POST /v1/messages and /v1/messages/count_tokens with the task's one-time token. It forces the task's model and removes server-side tools, MCP servers and beta headers. Then it makes an ordinary HTTP call to Ollama, vLLM or llm-bridge on the host's 127.0.0.1.

So the socket is not a general proxy. It is a single, narrow, metered API with a fixed destination. Check sandboxes (run_checks) don't get the socket at all.