claude-code - 💡(How to fix) Fix [Feature Request] Native sandbox support for Windows (non-WSL) [2 comments, 2 participants]

TL;DR

Implementing a Windows-specific sandboxing solution, such as utilizing Windows Sandbox or AppContainers, is likely necessary to achieve full security enforcement on native Windows.

Guidance

• Investigate the feasibility of integrating Windows Sandbox or AppContainers into Claude Code to provide OS-level isolation on Windows.
• Review existing issues (#43840, #45072, #37371, #46354) for potential insights into sandboxing challenges on Windows/WSL and how they might inform a native Windows solution.
• Consider the security implications of not having a sandboxing solution on Windows and prioritize the development of a native Windows sandbox feature.
• Evaluate whether any third-party libraries or tools can provide a suitable sandboxing solution for Windows until a native implementation is available.

Notes

The lack of a native Windows sandboxing solution currently limits the effectiveness of permission deny rules, allowing bash commands to bypass them.

Recommendation

Apply a workaround by using a third-party sandboxing tool or library until a native Windows sandbox feature is implemented, as this can provide some level of security enforcement, albeit not as seamless as a native solution.