Claude Sandbox

Claude Sandbox

 

**Unmaintained as of August 2026.** This is Windows-only and I no longer work on Windows, so I cannot test changes. It worked when I last ran it, in April 2026, against the versions of WSL2, Podman and Claude Code current then. It pins an external world it does not control - a Debian image digest, Podman for Windows, and Claude Code's own installer - so assume parts of it have drifted.

The reasoning is the part I would still stand behind: the [threat model](docs/threat-model.md) and the [decision records](docs/decisions/) explain what this is defending against and why each choice was made. Those do not go stale the way the scripts do.

`Test-Sandbox` runs 22 security checks and 15 installation checks, two of which expand at runtime - one per required package, one per credential-guard fixture - so a typical run reports 45 results. **Nothing runs them in CI**, so a passing count is something you get by running it, not something this page can promise you.

A one-command setup that creates an isolated Linux environment on Windows (via WSL2) purpose-built for [Claude Code](https://claude.ai/code). Your Windows projects stay on Windows - the sandbox mounts them on demand so Claude can work on them without touching the rest of your system.

What you get

• A clean Debian Linux distro running inside WSL2
• Claude Code installed and ready to go
• A switch-project command with tab completion to jump into any of your Windows projects
• Claude's state and settings persisted across distro rebuilds (no re-authentication)
• Full support for Claude's sandbox mode and network features (bubblewrap + socat)

Prerequisites

• Windows 10/11 with WSL2 enabled (wsl --install --no-distribution)
• Podman for Windows or Docker Desktop
• PowerShell (run as Administr