Skip to main content
A coding agent runs many commands in a session, and each command can read your credentials or send data out. pmg sandbox exec runs the agent and every process it starts under one sandbox policy. The sandbox:
  • Blocks reads and writes of credential files in the repository and in your home directory.
  • Removes secret variables, model API keys included, from the agent environment.
  • Makes the agent hook configuration read-only, so the agent cannot remove a hook such as Gryph.
  • Lets the agent write only in the repository, temporary directories, tool caches, and the state directory of its preset.
  • Sends every outbound connection through a PMG proxy that applies a network policy.
pmg sandbox exec is experimental. It runs on macOS and on Linux with the Landlock driver. It does not run with Bubblewrap or on Windows. This page needs PMG v0.33.0 or later. Install PMG with the PMG quickstart.

​
Run the agent in the sandbox

Each agent has a preset that adds its state directory, its own API key, and its own hosts.
To apply the preset on every run in this repository, save it once:

​
Limit the hosts the agent can reach

By default the agent can reach every host, and PMG records each destination. Build a network policy from a session, then enforce it.
1

Run a normal session

Do the work that the agent usually does in this repository.
2

Propose a profile

PMG writes the user profile agent in the PMG config directory, outside the repository, where the agent cannot change it. The profile allows each host that the session reached and denies every other destination. Open it with pmg sandbox profile edit agent and remove each host that the agent does not need.
3

Run the agent under the profile

The preset keeps the agent hosts open, such as its model API and sign-in. The profile keeps the hosts that the repository needs.
When the proxy refuses a destination, PMG prints the destination and the rule after the agent exits:

​
Fix a denied operation

The agent sees a permission error. After the session, find the cause and the command that allows it:
Git over SSH fails, because the sandbox blocks the SSH agent socket. Use an HTTPS remote.

​
Next steps

For the exec profile, custom profiles, the network flags, and the limits, see the sandbox exec documentation in the PMG repository. Read the hosts that a preset allows with pmg sandbox preset show claude.

Gryph

Record every file and command your coding agent touches.

Stop Install Scripts from Reading Your Secrets

Run package installs in the PMG sandbox.