Computing Life · Share · YageJul 20, 2026, 08:00 UTC+8

Why coding agents need sandboxes beyond command approval

为什么 Coding Agent 需要 Sandbox？

Approval gates only decide whether a command starts, not what happens after package managers load scripts and spawn child processes. The article walks through a bug-fix task to show how OS isolation (Seatbelt/bubblewrap), credential proxying (Docker Sandboxes), and isolated workspaces each address different risks. No performance numbers or latency figures are disclosed.

Why it matters: Hits all three HKR axes: the headline has genuine curiosity pull, the walkthrough of a full bug-fix task makes the sandbox-vs-alternatives comparison concrete, and it directly speaks to Cursor/Claude Code users who click that sandbox button daily. Docked a few points because i...

Read the original ↗Export Markdown

Take

This piece walks through a full bug-fix task—clone, npm install, edit, test, push—and uses it to explain why approval gates, command blacklists, and dedicated tools each miss what happens after a command starts. The useful framing: risks come from three places (model mistakes, prompt injection from external content, and third-party dependency scripts), and OS isolation handles all of them by limiting file and network access at the process level, without needing to know which source caused the problem.

Two things I'd flag. First, the distinction between "VM protects the host but not legitimate credentials" is well drawn: network policy controls destinations, credential proxying keeps raw tokens out of the sandbox, and external permission policy limits what a valid identity can do remotely. These three layers don't replace each other. Second, the article notes that workspace isolation lets you discard bad changes before they hit a shared branch—snapshots and git diff act as checkpoints, not security boundaries.

No performance numbers or latency figures here; this isn't a benchmark. It reads more like a security map for developers who already click "allow in sandbox" daily in Cursor or Claude Code but haven't thought through why. Worth ten minutes if that's you.

Source: Computing Life · Share · Yage · yage.ai
Published: Jul 20, 2026, 08:00 UTC+8 · Jul 20, 2026