Skip to main content
Installing a harness and its plugins in an environment decides what the agent brings with it. A sandbox decides what the agent can reach once it runs. This guide runs Claude Code inside a sandbox from the same environment. You need an environment set up as in the quickstart.

​
Choose a sandbox

Each sandbox is a package. Two are available: srt runs the agent inside Anthropic’s sandbox-runtime. Network access is limited to the hosts it allows. nono leaves the network open until you list allowed hosts, and needs no administrator setup on Linux. Install the one you want:

​
Launch the agent in the sandbox

Pass --sandbox between launch and the harness name:
The sandbox prints a line saying it is running the agent, then Claude Code starts as usual. If the sandbox package is not installed, the launch stops before starting anything and names the package to install. Start the agent from your project folder. The project folder is writable inside the sandbox, so both sandboxes refuse to start in / or in your home folder.

​
What the sandbox allows

Both sandboxes start from these defaults:
  • The project folder is writable, along with /tmp and Claude’s own state (~/.claude and ~/.claude.json).
  • ~/.ssh cannot be read.
  • Claude’s API hosts are reachable, as is every host named by an MCP server of the installed plugins.
With srt, no other host is reachable. With nono, the network stays open until you pass allowedDomains. The two also differ in what the agent can read. nono’s default profile hides ~/.ssh and other credential folders. srt hides only ~/.ssh: the agent can read the rest of your home folder, including credentials such as ~/.aws. With srt, hide them with denyRead:

​
Pass options to the sandbox

Pass options as one JSON object with --sandbox-options. Both sandboxes accept the same three keys, and each value is a list of strings that is added to the defaults: For example, to let the agent reach GitHub:
flox agent launch checks only that the value is a JSON object. The sandbox checks the keys, and reports an unknown key or a value that is not a list of strings without starting the agent. To see the settings srt would apply without starting the agent, set AGENT_SANDBOX_SRT_DRY_RUN=1. For nono, the variable is AGENT_SANDBOX_NONO_DRY_RUN=1.

​
Flags for the agent

Flags for flox agent launch go before the harness name. Everything after the harness name belongs to the harness:

​
Ubuntu 24.04 and later

Ubuntu 24.04 restricts unprivileged user namespaces, which srt needs on Linux. When that restriction is on, agent-sandbox-srt stops and prints the one-time administrator step that allows it. nono does not need this step.