Sanbox By Sanlabs

Guides

Secrets, egress and blast radius

Guide

How do I use --dangerously-skip-permissions in a disposable computer?

By the Sanbox team updated

Ask ChatGPT Ask Claude

You can't make the flag itself safe, but you can make a mistake cheap. Run the agent on a separate machine with no personal files, no production credentials and a short network allowlist, and take a restore point first. On Sanbox, prepare a Computer, stop it and snapshot it, run Claude Code with --dangerously-skip-permissions inside it, review the diff, and if anything goes wrong start a fresh copy from the snapshot. Claude Code's own documentation says to use this mode only in isolated environments such as containers or VMs.

Run this with your agent

Read https://sanbox.cloud/kb/security/snapshot-before-skip-permissions.md and follow it to set up a disposable Computer for Claude Code with permissions skipped.
If the Sanbox CLI is missing, install it with `npm install -g @sanlabs/sanbox-cli@latest`
and sign in with `sanbox login`. Show me each command before you create, stop or delete a Computer.

What does the flag turn off?

According to Claude Code's documentation:

  • --dangerously-skip-permissions equals --permission-mode bypassPermissions. It turns off permission prompts and safety checks, so tool calls run at once, including writes to protected paths such as .git and .claude.
  • Some checks remain. Deny rules still block, explicit ask rules still prompt, and removing critical paths with rm still asks.
  • It refuses to run as root. On Linux and macOS, Claude Code won't start in this mode as root or under sudo, unless it detects a recognised sandbox.
  • It gives no protection against prompt injection. The docs recommend isolated environments without internet access, where Claude Code can't damage your host.

Codex has an equivalent, --dangerously-bypass-approvals-and-sandbox (also --yolo), which its docs say to use only inside an externally hardened environment.

Steps

1. Write a short allowlist

Claude Code needs its API, its sign-in hosts and the npm registry to install. Save this as claude-policy.json:

{
  "default_action": "deny",
  "rules": [
    { "destination": "api.anthropic.com", "ports": [{ "from": 443, "to": 443 }], "description": "Claude API" },
    { "destination": "claude.ai", "ports": [{ "from": 443, "to": 443 }], "description": "Claude sign-in" },
    { "destination": "platform.claude.com", "ports": [{ "from": 443, "to": 443 }], "description": "Claude sign-in and tokens" },
    { "destination": "registry.npmjs.org", "ports": [{ "from": 443, "to": 443 }], "description": "npm" }
  ]
}

2. Create a template and start a Computer

The OpenCode Computer image includes Node 22, npm, git and zellij. Creating templates needs the admin or owner role:

sanbox templates create --name "Claude Code scratch" --type opencode-computer \
  --model-provider <provider-id> --model <model-id> \
  --network-policy claude-policy.json --json
sanbox run --template <template-id> --json
sanbox runs get <run-id> --json

3. Copy in a clean checkout

From your repository's root, clone it so untracked files such as .env stay behind, then copy the clone in:

git clone . /tmp/app
sanbox cp /tmp/app <run-id>:/workspace

4. Install Claude Code, then run it as the normal user

Install it once into the Computer's system path, so it's available in SSH, in the browser terminal and to every later fork. Then open a shell as the normal user. Claude Code refuses to skip permissions as root, and you don't want it to run as root anyway:

sanbox exec <run-id> --root -- npm install -g @anthropic-ai/claude-code
sanbox ssh <run-id>

Inside the shell:

claude --version
claude

Don't sign in yet. Take the snapshot first, so it holds Claude Code but nobody's login. The browser terminal and SSH keep separate home directories, so later sign in from the one you'll use. The headless login guide covers the options.

5. Snapshot the prepared Computer

sanbox runs stop <run-id> --wait --json
sanbox snapshots create --run <run-id> --name claude-clean --wait
sanbox runs resume <run-id> --wait --json

The snapshot has Claude Code installed and no login in it. Sign in on the resumed Computer, and on each Computer you start from the snapshot. For a Computer several people share, use an API key rather than a personal plan login.

6. Run with permissions skipped

Interactively, open sanbox ssh <run-id> again and work inside zellij, so the session survives a dropped connection:

zellij attach -c claude
cd /workspace/app
claude --dangerously-skip-permissions

Or unattended, as a detached command you can follow from your laptop:

sanbox exec <run-id> --cwd /workspace/app --detach --json -- \
  'claude -p "Fix the failing tests and run them" --dangerously-skip-permissions'
sanbox commands logs <run-id> <command-id> --follow

A command can run for up to 3600 seconds by default; set --timeout up to 86400 for longer jobs. If claude -p run through sanbox exec reports that it isn't signed in, run the same command inside the zellij session where you signed in.

7. Review the diff

sanbox exec <run-id> --cwd /workspace/app -- 'git add -A && git diff --cached --stat'
sanbox exec <run-id> --cwd /workspace/app -- 'git diff --cached > /workspace/change.patch'
sanbox cp <run-id>:/workspace/change.patch .

8. Start over when it goes wrong

sanbox runs stop <run-id> --wait --json
sanbox run --snapshot claude-clean --json
sanbox runs delete <run-id> --yes --json

Snapshot it

The snapshot is your clean starting point, so keep it current. When your dependencies change, prepare a Computer again and take a new snapshot. You can also keep the prepared Computer stopped as your baseline and run each attempt in a fork with sanbox runs fork <run-id> --request-key <uuid> --wait --json. Delete forks you don't need.

What this doesn't do

  • It doesn't make the agent's work correct, and it doesn't stop prompt injection. It limits what a confused or hijacked agent can reach.
  • An allowlist isn't "no internet". The agent can still send what it reads to the hosts you allowed. Keep the list short.
  • It doesn't hide what you copy in. The repository and its history are readable, and the Claude Code login on disk travels into snapshots and forks.
  • A snapshot restores the Computer, not the world. Changes the agent made through an allowed API stay made.
  • It doesn't replace Claude Code's own controls. Deny rules still apply in this mode, and Claude Code's auto mode is an option when you want fewer prompts with background safety checks.

Sources