Sandboxing: which agent is confined, where
For each agent backend and platform: whether the engine confines it, and what happens when it does not.
The engine confines an agent run with the operating system's own mechanism — Landlock or bubblewrap on Linux, Seatbelt on macOS — so that the agent can write only inside its working directory and a short list of named locations (see Runners). Whether it can do that depends on the backend and the platform, because some agent tools bring a sandbox of their own, and two sandboxes do not always nest.
The matrix
| backend | Linux | macOS |
|---|---|---|
claude-code | confined by the engine | confined by the engine |
codex | confined by the engine; codex's own sandbox is switched off so the two do not collide | not confined by the engine: codex runs under its own sandbox, and the run record says the engine makes no claim |
qwen-code | confined by the engine | not confined by the engine: its sandbox collides with the engine's, so the engine does not nest them; the run record says so |
droid | confined by the engine | not confined by the engine; the run record says so |
cursor | refused | refused |
openai-compat | not applicable: the model call is made by the engine itself, in process | not applicable |
agent-loop | not applicable: it applies its own confinement | not applicable |
proc | not applicable: it runs operator executables you name | not applicable |
A run that the engine does not confine is never described as confined: its record states that no engine boundary was claimed.
The confinement setting
run.confinement chooses the posture for the whole installation:
| value | meaning |
|---|---|
engine (default) | the engine composes the boundary above |
container | the run is placed in one of Saphan Studio's container images. Local machine only — refused for remote runs. The same backend rules apply: on a macOS host, codex, qwen-code and droid get no container either |
vendor | confinement is handed to the agent backend; the run record says that the engine makes no claim that the agent is confined |
Remote machines
On a machine reached over ssh the boundary is applied by that machine, using the confinement its
record shows after saphan machine probe-confinement — Landlock on Linux, Seatbelt on macOS. A machine
that has not been probed, or whose confinement is below the minimum, is refused. See
Preparing a machine.
What confinement does not do
- It bounds writes, not reads. What a run cannot read depends on the lane; on the default local lane it can read the machine's signing-key directory. See Runners.
- It is not egress control. What a run may connect to is decided by egress control, a separate layer.
- See Documented limits for the remaining residuals.