Lesson 6 · 20 min
A rule and a hook read the command; the sandbox reads nothing: the operating system simply won't let the process write outside the folder or open the network. But a sandbox can also fail silently. In this lesson you prove, with four escape attempts, what holds on your machine, and you see two locks that did not hold on this one.
Start the lesson
Goal: prove on your machine that the sandbox blocks writes outside the folder and network access, instead of trusting the flag.
Click each probe.
Secondary-source report: Help Net Security records sandbox and allowlist failing in 2026 in Cursor and Codex CLI. The practical conclusion is to prove the lock, not to ask for more confirmation.
No lock, the Codex sandbox in the :read-only and :workspace profiles, and systemd-run with PrivateNetwork and ProtectHome. No model.
P=~/projetos/loop-r-eng-seguranca-v72/kit/prova-isolamento.sh W=/tmp/ensaio-seg/iso; mkdir -p $W echo "## sem trava"; bash $P; echo "saída: $?" echo "## codex sandbox :read-only"; bash $P codex sandbox -P :read-only -C $W --; echo "saída: $?" echo "## codex sandbox :workspace"; bash $P codex sandbox -P :workspace -C $W --; echo "saída: $?" echo "## systemd-run PrivateNetwork + ProtectHome" bash $P systemd-run --user --pipe --wait --quiet -p PrivateNetwork=yes -p ProtectHome=read-only -- echo "saída: $?"
## sem trava escreve-dentro ABERTO escreve-fora ABERTO rede ABERTO le-segredo ABERTO aviso: lê arquivos fora da pasta; tire segredos do alcance ou corte a rede ISOLAMENTO: FURADO (2 fuga(s)) saída: 1 ## codex sandbox :read-only escreve-dentro BLOQUEADO escreve-fora BLOQUEADO rede BLOQUEADO le-segredo ABERTO aviso: lê arquivos fora da pasta; tire segredos do alcance ou corte a rede aviso: nem a pasta de trabalho é gravável (bom para revisar, não para executar) ISOLAMENTO: OK saída: 0 ## codex sandbox :workspace escreve-dentro ABERTO escreve-fora BLOQUEADO rede BLOQUEADO le-segredo ABERTO aviso: lê arquivos fora da pasta; tire segredos do alcance ou corte a rede ISOLAMENTO: OK saída: 0 ## systemd-run PrivateNetwork + ProtectHome escreve-dentro ABERTO escreve-fora ABERTO rede ABERTO le-segredo ABERTO aviso: lê arquivos fora da pasta; tire segredos do alcance ou corte a rede ISOLAMENTO: FURADO (2 fuga(s)) saída: 1
codex-cli 0.163.0, systemd 255. systemd accepted the flags and ran without them; the journal logged "PrivateNetwork=yes is configured, but the kernel does not support or we lack privileges for network namespace, proceeding without".
On this Ubuntu, kernel.apparmor_restrict_unprivileged_userns=1 stops the user's systemd from creating the namespaces. Codex only works here because bubblewrap got its own AppArmor profile (10/01/2026). On another machine it may be the other way around: that's why the proof runs on yours.
According to each one's docs, read on 10/19/2026.
codex exec -s read-only or -s workspace-write runs the model's commands in a sandbox (on Linux, bubblewrap with a seccomp filter, per the codex sandbox docs). The docs recommend workspace-write for unsupervised local work and reserve --yolo for a runner that is already isolated.
codex sandbox -P [profile] -- [command] runs a command of yours in the sandbox, with no model: that's what the rehearsal uses. The :read-only and :workspace profiles were observed on 0.163.0.
sandbox.enabled puts Bash commands inside a system-level boundary: limited writes, and network only through a proxy with a domain list. On Linux it depends on bubblewrap and socat.
The sandbox covers shell commands; the file tools, MCP, and hooks run outside it (per the docs). For those, the rules from lesson 4 apply.
By default, if the Claude Code sandbox can't start, it runs the commands without a sandbox. With sandbox.failIfUnavailable: true, it refuses to start.
In the loop, turn on failIfUnavailable: a missing lock has to stop the loop, not let it run wide open.
"By default, if the sandbox can't start because a dependency is missing or the platform is unsupported, Claude Code runs commands without sandboxing."
This machine is missing socat. With failIfUnavailable, Claude Code refuses to start before any call to the model (it doesn't use your subscription quota).
cd /tmp/ensaio-seg/iso
claude --settings '{"sandbox":{"enabled":true,"failIfUnavailable":true}}' -p "responda só: ok" --tools ""
echo "saída: $?"Error: sandbox required but unavailable: sandbox is enabled but dependencies are missing: socat not installed · install missing tools (e.g. apt install bubblewrap socat) or see https://code.claude.com/docs/en/sandboxing sandbox.failIfUnavailable is set — refusing to start without a working sandbox. saída: 1
Claude Code 2.1.303. Without failIfUnavailable, per the docs, the same session would have run the commands without a sandbox.
Install bubblewrap and socat (the error itself suggests apt install bubblewrap socat) and run it again: the session starts and responds. Then ask Claude to run the prova-isolamento.sh probes, one at a time, and check for BLOQUEADO on escreve-fora and rede.
The four locks on your machine, and the lock on your loop.
Run the rehearsal. Note which locks came back OK on your machine; the systemd result may differ from the one here.
Done when: "sem trava" ends in ISOLAMENTO: FURADO (2 fuga(s)) and saída: 1; "codex sandbox :workspace" in escreve-dentro ABERTO, ISOLAMENTO: OK and saída: 0.
Run the Claude Code block. If it refuses to start, install the dependencies the error asks for and run it again.
Done when: without the dependencies: refusing to start without a working sandbox and saída: 1; with them: saída: 0.
Run prova-isolamento.sh with the same wrapper your loop uses to call the agent (the same -s from Codex, the same systemd-run). Note the date and the result in the map ("prova_isolamento"), for lesson 8.
Done when: bash $P [your loop's wrapper] --; echo $? → ISOLAMENTO: OK and 0.
Question 1 of 4
systemd accepted PrivateNetwork=yes with no error. Is the network cut off?skill
Question 2 of 4
What does Claude Code do, by default, if the sandbox can't start?skill
Question 3 of 4
In the :workspace profile, the agent can read a secret in ~/.config. What should you do?
Question 4 of 4
What is the difference between the sandbox and the deny rule from lesson 4?
Choose an option. The explanation appears after your attempt.