Claude Code Sandbox vs Docker: 8 Wrappers, 2 Ran Headless

The first wrapper I tried ate my prompt. I ran cco --backend native -p "Reply with the single word ok" on this Mac mini at 16:36 KST today and got back Error: Input must be provided either through stdin or as a prompt argument when using --print, because -p is cco's own short flag for --packages, an apt package list. Claude Code never saw the prompt. Piping it in and spelling out --print worked on the second try, seven seconds end to end, and that is the whole reason I sat down to compare these tools: a sandbox is only a boundary for my fleet if a shell script can start it without a human at the keyboard.

Six of my launchd jobs still run claude -p --dangerously-skip-permissions straight on the host, which I wrote up when Docker Sandboxes shipped and have not fixed since. On September 7 a Hacker News thread about Trail of Bits' coop (71 points, 16 comments) did something useful: the commenters named their alternatives. Docker sbx, microsandbox, Eclipse Enclave, bubblewrap, cco, drydock. Add Anthropic's own srt and the sandbox built into Claude Code and you have nine things that all claim to contain the same binary. Nobody had put them on one table, so I read each one's README, trust model, and CLI reference on September 13 and did.

Nine sandboxes, one table

Columns are what I would need to know before pointing a timer at any of them. "Claude runs as" is what the wrapper does about permission prompts inside the boundary. "Headless path" is the documented way to run one prompt and exit, which is the only way my jobs run. Stars and release dates are from the GitHub API on 2026-09-13.

Tool	Boundary	Runs on	License	Default network	Claude runs as	Headless path
Claude Code built-in /sandbox	Seatbelt on macOS, bubblewrap on Linux; Bash tool only	macOS, Linux, WSL2	part of Claude Code	no domains pre-allowed, prompts per new domain	separate axis; the docs table says the flag changes nothing here	claude -p with sandbox.enabled in --settings
anthropics/sandbox-runtime (srt, 5,215 stars, v0.0.76 on 09-10)	same primitives, any process	macOS, Linux, Windows via a dedicated user	Apache-2.0	all denied, allow-only	not its concern	srt -s file bash -c 'claude --print', ran here
nikvdp/cco (424 stars, no release, master pushed 09-12)	sandbox-exec native, host filesystem read-only; Docker fallback	macOS, Linux	MIT	full host network	skip-permissions on by design	--print plus stdin, ran here; -p is --packages
trailofbits/coop (229 stars, v0.6.0 on 09-09)	VM: Firecracker on Linux, Lima on macOS	macOS arm64, Linux x86_64	Apache-2.0	guest outbound open	guest settings.json sets bypassPermissions; --ask restores prompts	coop exec -- ..., no PTY, stdin not forwarded
docker/sbx-releases (374 stars, v0.42.1 on 09-07)	microVM, own kernel	macOS 14+ Apple silicon, Windows 11, Ubuntu 24.04+ with KVM	proprietary	deny-by-default through a host proxy, defaults "include broad wildcards"	default command is claude --dangerously-skip-permissions	sbx create then sbx exec; PAT login via --password-stdin
eclipse-enclave/enclave (45 stars, rolling release)	Docker container, experimental qemu	Linux, macOS with Docker Desktop, Windows via WSL2	MIT	restricted to an allowlist via dnsmasq and a proxy	YOLO mode enabled by default, --no-yolo	-- passthrough shown only for the shell tool
sricola/drydock (8 stars, v0.7.0 on 08-07)	throwaway VM per task on Apple's container runtime	macOS 26+ Apple silicon only	Apache-2.0	deny-by-default, seven hosts allowlisted	unattended, then a diff you approve	drydock queue add; a launchd daemon page exists
microsandbox (8,240 stars, v0.6.18 on 09-09)	microVM runtime with SDKs	macOS Apple silicon, Linux KVM, Windows WHP	Apache-2.0	per-sandbox config	no Claude integration of its own	msb exec
OtoDock/oto-dock (169 stars)	server platform, kernel sandbox per agent	a Linux server with Docker	FSL-1.1	private ranges and metadata blocked	platform decides	web UI and scheduler

bubblewrap is on the thread but not on the table: it is the Linux primitive that srt, the built-in sandbox, and cco's Linux mode all sit on, not a wrapper anyone runs Claude through directly. toolgate, also named, is a permission gate rather than a boundary.

What the table says

Every wrapper that launches Claude Code itself turns off its permission prompts. Docker's Claude Code page gives claude --dangerously-skip-permissions as the default command. coop's trust model writes defaultMode: bypassPermissions into the guest's settings and calls the guest "deliberately permissive" because "the whole VM is the blast radius." Enclave's CLI reference lists YOLO mode as enabled in its defaults table. cco's README says the point is the skip-permissions experience with the risk contained. In all four the boundary replaces the prompt, which is also what my six jobs do, minus the boundary.

Network defaults split three ways, and the split matters more than the isolation tier. Two tools deny everything until you list hosts: srt, and drydock with its seven-host allowlist that routes the model API through a credential gateway on port 8088. Two ship an allowlist with room in it: Docker's security page says the defaults "include broad wildcards," and Enclave resolves only allowlisted domains through dnsmasq. Two leave the guest open: coop's docs state the guest has outbound access and Claude keeps auto-updating inside it, and cco's native mode uses the full host network so local MCP servers keep working.

The built-in sandbox is its own fourth case: it pre-allows nothing and asks per domain, which in a -p run becomes the auto-mode classifier's call.

Credentials are where the VM tools earn their complexity. Docker's proxy injects auth headers on the host so "the raw credential values never enter the VM." drydock's gateway holds the real key and hands each task a token with a $2.00 default budget. coop forwards ANTHROPIC_API_KEY over SSH SendEnv, never to disk in the guest, with an opt-in proxy mode that keeps it out entirely. The Seatbelt-tier tools inherit the parent environment by default; the built-in sandbox can mask or unset variables through a credentials block, and cco reads the OAuth credential out of the macOS Keychain and mounts it for the run. On this rig the Keychain read is the one that matched reality: cco's stderr said Verified Claude Code credentials in macOS Keychain and the run authenticated without an API key.

The two that ran here

This Mac has none of the runtimes the VM and container tiers need. which returns nothing for docker, limactl, sbx, bwrap, or Apple's container; it does have /usr/bin/sandbox-exec and kern.hv_support: 1.

drydock is the interesting near miss: it requires macOS 26 or later on Apple silicon, this is 26.4.1, and its docs have a page on running the broker as a launchd daemon, which is the closest any of the nine comes to my setup. It still needs Apple's container runtime installed first, and I did not install anything for this post. Everything about coop, sbx, Enclave, and drydock above is read, not observed.

srt I ran through npx without installing, stdin closed, no TTY. With no settings file it refused every network connection (curl to api.anthropic.com and example.com both returned 000), let me read .env in my repo, and refused every write: touch in the working directory, in /tmp, and in my home directory all came back Operation not permitted, whether I started from /tmp or from ~/work. The default is deny-all on writes, which is stricter than the built-in sandbox's documented working-directory allowance. My first attempt also failed on argument shape, exit 127, because srt passed my whole semicolon-joined string as one command name; wrap it in bash -c. Then the settings file rejected an allowlist-only config with network.deniedDomains: Required, filesystem.denyRead: Required, filesystem.denyWrite: Required. Empty arrays satisfy it. With those in place:

echo "Reply with the single word ok" | \
  npx -y @anthropic-ai/sandbox-runtime@latest -s ./srt-settings.json \
  bash -c 'claude --print --model claude-haiku-4-5-20251001'
# ok   (exit 0, 16:37:52 to 16:37:57 KST)

cco I cloned and ran from the checkout rather than through its install script. The -p collision is in the source: --packages | -p) at line 3248 of the cco script, and the help text confirms it as "Install additional apt packages." So the one-letter flag every headless Claude Code script uses is silently a different flag here, and the error you get is Claude Code's, not cco's. I have a whole post on that error message from the last time a wrapper swallowed my prompt. The fix is the long form:

echo "Reply with the single word ok" | \
  ./cco --backend native --yes --model claude-haiku-4-5-20251001 --print
# ok   (exit 0, 16:37:11 to 16:37:18 KST)

Seven seconds against srt's five, with the difference being cco's Keychain verification and its --add-dir for the git common directory. Both runs were real Claude Code sessions on Haiku, started from probe directories so they stay out of my session counts.

What I would put on a timer

The honest answer is that neither probe changed my launchd jobs yet, and the reason is the write policy. The jobs append to LOG.md, write research notes, and call the deploy script; under srt's defaults every one of those is Operation not permitted, and under cco's native mode the host filesystem is read-only outside the project with the network wide open, which closes the hole I care least about and leaves the one I care most about. The built-in sandbox I tested in July has the same shape: Bash contained, file tools and egress not. Getting a usable policy means listing the seven or eight paths a job legitimately writes and the four hosts it legitimately calls, per job, and then testing that a deploy still deploys. That is a settings file, not a VM, and it is one line in the launcher script to add. It is also work I have talked about in three posts now and done in none.

What the comparison did settle is which tier is even a candidate. For a fleet that starts from a plist, a wrapper that needs sbx login in a browser, a Lima VM booted per project, or a container daemon that is not installed is not a candidate this month, whatever its boundary looks like. The Seatbelt tier is, because it is already on the machine. If you are building the same kind of unattended rig, the launcher script and the deny rules that survive the skip-permissions flag are in the playbook, and the sandbox settings file will go in once I have one that deploys.

FAQ

Is the Claude Code built-in sandbox the same as Docker Sandboxes?

No. The built-in sandbox confines only the Bash tool using Seatbelt on macOS or bubblewrap on Linux, inside the same process and kernel as the host. Docker Sandboxes runs the whole agent in a microVM with its own kernel and proxies its network and credentials from the host. They contain different things and fail differently.

Which Claude Code sandbox works headless on macOS without Docker?

Two did on a Mac with nothing installed: Anthropic's srt via npx with a settings file, and cco in native mode from a git checkout. Both need the prompt on stdin with --print; with cco, -p means --packages.

Do sandbox wrappers still use --dangerously-skip-permissions?

Yes, by default. Docker's sandbox starts claude --dangerously-skip-permissions, coop sets bypassPermissions in the guest settings, Enclave enables YOLO mode, and cco is built around the flag. The boundary is meant to replace the prompt, so the prompt goes.

Sources and method: the table is normalized from each project's README, trust model, and CLI or docs pages as fetched on 2026-09-13, with stars and latest release dates from the GitHub API at 16:31 KST; the tool list is the set named in the coop thread plus Anthropic's runtime and the built-in sandbox. Quoted defaults are from Docker's security and Claude Code agent pages, coop's trust-model.md and claude-integration.md, Enclave's cli-reference.md, drydock's egress and daemon pages, and the Claude Code sandboxing documentation. The two probes ran on this Mac mini (macOS 26.4.1, Apple silicon) between 16:36 and 16:38 KST with stdin closed and no TTY, srt 1.0.0 through npx and cco from a fresh clone of master; timings are from date before and after each run. I did not install coop, sbx, Enclave, drydock, or microsandbox, so every statement about them is cited from their documentation, not observed.