Critically, in the intended approach for this, Claude itself (the harness) runs outside the sandbox. Their approach means you trust Claude is perfect, just the commands it runs need isolation. And to some extent, you trust its judgement on what and when needs the isolation applied.
I know there are distinct camps here, and the long term story may evolve - but for now I just want the whole harness inside a sandbox - ideally, a full VM - and THEN you can further sandbox things it runs if you really want different tiers within that.
I know there are distinct camps here, and the long term story may evolve - but for now I just want the whole harness inside a sandbox - ideally, a full VM - and THEN you can further sandbox things it runs if you really want different tiers within that.