Image: michaellivs.com
Inside the sandbox behind Claude's code execution
Claude was used to inspect its own code execution sandbox, revealing gVisor isolation, an egress proxy and a large preinstalled image.
Credits
Earliest dated source:
The full story
Curious how Anthropic built Claude's code execution feature, the poster used Claude itself to inspect its environment. They report gVisor as the isolation layer, code running as root inside the sandbox, and network access through a JWT-authenticated egress proxy that allows sites such as pypi.org and github.com.
They also found a custom /process_api binary running as PID 1 and an image of about 9GB containing ffmpeg, ImageMagick, LaTeX, Playwright and LibreOffice. A full write-up and an open-source project, agentbox, accompany the post.
How it was done
Tools
Themes
Loading themes…
Sources
From a short post by the maker, so the details are as they tell them.
- Reddit: I reverse-engineered Claude's code execution sandbox - here's how it worksReddit poster: MiclivsPosted
The maker's post on r/ClaudeAI.
If it disappears: archived copy of Reddit: I reverse-engineered Claude's code execution sandbox - here's how it works (opens in a new tab)
- The project: michaellivs.com
The write-up on the maker's blog.