Agentic Sandboxes

Each sandbox is either an OrbStack isolated machine (Linux) or a Tart VM (tagged macOS, for Xcode work). No host files shared except one mounted folder, no access to the macOS host or your LAN, internet allowed, SSH agent forwarding off. Built for running agents with permissions off. By maintaining a golden base machine per backend that is built once and then only cloned thereafter, creating another sandbox only takes seconds.

Folder	Backend	Agent	Network
Claude/	OrbStack	Claude	internet yes, LAN + host no
Pi/	OrbStack	pi	same, plus tunnel to the host's oMLX server
Local/	OrbStack	pi	loopback only, fully local, host oMLX only
macOS/	Tart	Claude	Softnet: internet yes, LAN + host no

On Linux, LAN blocking is nftables baked into the base (OrbStack's --isolate-network covers host and other machines, not the physical LAN) and the sandbox user has no sudo, so the agent can't undo it. On macOS, Softnet enforces the same policy from outside the guest.

Usage

# dependencies
brew install orbstack
brew install cirruslabs/cli/tart

# build the golden base (minutes for Orbstack, Tart download is large)
sandbox base
sandbox base --macos

# create sandboxes
sandbox new api-v1 # Claude Code
sandbox new api-v2 --pi # pi + oMLX (tunnel on 127.0.0.1:8000)
sandbox new secret-v1 --local # same as --pi without internet
sandbox new ios-v1 --macos [--gui] # --gui allows watching simulator

# start a session
sandbox shell api-v1
claude --dangerously-skip-permissions

# database
createdb sandboxdb
export DATABASE_URL=postgres://$USER@localhost:5432/sandboxdb

Verify isolation inside sandbox

# Try to reach internet. 200, unless --local
curl -sS https://github.com -o /dev/null -w '%{http_code}\n'
curl -m 3 http://192.168.1.1        # blocked (LAN, nftables)
curl -m 3 http://host.orb.internal  # blocked (Mac, --isolate-network)
sudo nft list ruleset               # fails: no sudo by design
ls /mnt/mac 2>&1                    # nothing shared

Caveats

• The OrbStack containers share one kernel, which is not suited for code that actively tries to exploit the kernel / escape the sandbox.
• Outbound internet is open by default. Use --local to set up a container without internet access and pi.dev agent.
• Host-side habits matter. An agent could e.g. write symlinks pointing at ~/.ssh, which it can not reach itself within the container.
• Specifically created fo macOS (but the principle is transferrable).