Description
The /sandbox feature — the single most impactful security setting in Claude Code — is unavailable on native Windows. It uses Seatbelt on macOS and bubblewrap on Linux, but has no Windows equivalent.
Impact
Without sandbox, permission deny rules only block Claude's built-in tools. Bash commands bypass them entirely. For example, Read(~/.ssh/**) in the deny list prevents the Read tool from accessing SSH keys, but Bash(cat ~/.ssh/id_rsa) would still work. The sandbox is what enforces deny rules at the OS level — without it, deny rules are a partial mitigation at best.
Windows users currently have no path to full security enforcement.
Existing Windows sandbox issues
Current filed issues (#43840, #45072, #37371, #46354) are about sandbox breaking on Windows/WSL. This is a feature request for native Windows sandbox support that doesn't require WSL — potentially using Windows Sandbox, AppContainers, or similar OS-level isolation mechanisms.
Environment
- Claude Code 2.1.84
- Windows 10 Pro 10.0.19045
Description
The
/sandboxfeature — the single most impactful security setting in Claude Code — is unavailable on native Windows. It uses Seatbelt on macOS and bubblewrap on Linux, but has no Windows equivalent.Impact
Without sandbox, permission deny rules only block Claude's built-in tools. Bash commands bypass them entirely. For example,
Read(~/.ssh/**)in the deny list prevents the Read tool from accessing SSH keys, butBash(cat ~/.ssh/id_rsa)would still work. The sandbox is what enforces deny rules at the OS level — without it, deny rules are a partial mitigation at best.Windows users currently have no path to full security enforcement.
Existing Windows sandbox issues
Current filed issues (#43840, #45072, #37371, #46354) are about sandbox breaking on Windows/WSL. This is a feature request for native Windows sandbox support that doesn't require WSL — potentially using Windows Sandbox, AppContainers, or similar OS-level isolation mechanisms.
Environment