# anthropic-experimental/sandbox-runtime architecture

> Architecture diagram of the GitHub repository anthropic-experimental/sandbox-runtime, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-24). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/anthropic-experimental/sandbox-runtime
- Repository: https://github.com/anthropic-experimental/sandbox-runtime

## Overview

srt wraps a command-line process or library-managed process in OS-enforced filesystem and network restrictions. The principal flow loads and validates settings, initializes platform isolation and host-side network proxies, then wraps and launches the command; proxy requests are filtered before being forwarded. The graph also preserves credential handling, TLS interception, and violation monitoring as product capabilities. README documentation supports the platform and isolation overview; sampled excerpts clarify CLI, manager, and proxy ownership, but do not expose every subsystem’s internal wiring.

Main entry points: [`src/sandbox/sandbox-manager.ts`](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-manager.ts) (Sandbox manager), [`src/cli.ts`](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/cli.ts) (CLI), [`src/sandbox/http-proxy.ts`](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/http-proxy.ts) (HTTP proxy), [`src/sandbox/tls-terminate-proxy.ts`](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/tls-terminate-proxy.ts) (TLS termination)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["Entry and configuration"]
  node_cli["CLI<br/>[cli.ts]"]
  node_config["Config loader<br/>[config-loader.ts]"]
  node_schema["Config schemas<br/>[sandbox-config.ts]"]
  node_manager["Sandbox manager<br/>[sandbox-manager.ts]"]
end

subgraph group_isolation["Process isolation"]
  node_macos["macOS isolation"]
  node_linux["Linux isolation"]
  node_windows["Windows isolation"]
end

subgraph group_network["Network mediation"]
  node_http["HTTP proxy<br/>[http-proxy.ts]"]
  node_socks["SOCKS proxy<br/>[socks-proxy.ts]"]
  node_mux["Proxy mux<br/>[mux-proxy.ts]"]
  node_filter["Request filter<br/>[request-filter.ts]"]
  node_parent["Parent proxy<br/>[parent-proxy.ts]"]
  node_tls["TLS termination"]
  node_ca["MITM certificates<br/>[mitm-ca.ts]"]
end

subgraph group_security["Credentials and monitoring"]
  node_credentials["Credential controls"]
  node_substitution["Body substitution"]
  node_monitor["Violation monitor"]
  node_violations[("Violation store")]
end

node_user(("Caller"))
node_process(("Sandboxed process"))
node_network_service(("Remote network"))

node_user -->|"runs command"| node_cli
node_cli -->|"loads settings"| node_config
node_config -->|"validates config"| node_schema
node_cli -->|"initializes sandbox"| node_manager
node_manager -->|"builds isolation"| node_macos
node_manager -->|"builds isolation"| node_linux
node_manager -->|"builds isolation"| node_windows
node_cli -->|"wraps command"| node_manager
node_cli -->|"spawns wrapped command"| node_process
node_manager -->|"starts listeners"| node_mux
node_mux -->|"dispatches HTTP"| node_http
node_mux -->|"dispatches TCP"| node_socks
node_http -->|"checks requests"| node_filter
node_http -->|"terminates TLS"| node_tls
node_http -.->|"forwards via parent"| node_parent
node_tls -->|"checks requests"| node_filter
node_tls -->|"mints certificates"| node_ca
node_tls -->|"transforms bodies"| node_substitution
node_http -->|"forwards traffic"| node_network_service
node_socks -->|"forwards traffic"| node_network_service
node_tls -->|"forwards HTTPS"| node_network_service
node_manager -->|"enables monitoring"| node_monitor
node_monitor -->|"records events"| node_violations
node_filter -->|"applies credential rules"| node_credentials

click node_cli "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/cli.ts"
click node_config "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/utils/config-loader.ts"
click node_schema "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-config.ts"
click node_manager "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-manager.ts"
click node_macos "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/macos-sandbox-utils.ts"
click node_linux "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/linux-sandbox-utils.ts"
click node_windows "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/windows-sandbox-utils.ts"
click node_http "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/http-proxy.ts"
click node_socks "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/socks-proxy.ts"
click node_mux "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/mux-proxy.ts"
click node_filter "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/request-filter.ts"
click node_parent "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/parent-proxy.ts"
click node_tls "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/tls-terminate-proxy.ts"
click node_ca "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/mitm-ca.ts"
click node_credentials "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/credential-extract.ts"
click node_substitution "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/body-substitution.ts"
click node_monitor "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/linux-violation-monitor.ts"
click node_violations "https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-violation-store.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_config,node_schema,node_manager toneBlue
class node_macos,node_linux,node_windows toneAmber
class node_http,node_socks,node_mux,node_filter,node_parent,node_tls,node_ca toneMint
class node_credentials,node_substitution,node_monitor,node_violations toneRose
class node_user,node_process,node_network_service toneIndigo
```

## Components

### Entry and configuration

- [CLI](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/cli.ts): `src/cli.ts`
- [Config loader](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/utils/config-loader.ts): `src/utils/config-loader.ts`
- [Config schemas](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-config.ts): `src/sandbox/sandbox-config.ts`
- [Sandbox manager](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-manager.ts): `src/sandbox/sandbox-manager.ts`

### Process isolation

- [macOS isolation](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/macos-sandbox-utils.ts): `src/sandbox/macos-sandbox-utils.ts`
- [Linux isolation](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/linux-sandbox-utils.ts): `src/sandbox/linux-sandbox-utils.ts`
- [Windows isolation](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/windows-sandbox-utils.ts): `src/sandbox/windows-sandbox-utils.ts`

### Network mediation

- [HTTP proxy](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/http-proxy.ts): `src/sandbox/http-proxy.ts`
- [SOCKS proxy](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/socks-proxy.ts): `src/sandbox/socks-proxy.ts`
- [Proxy mux](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/mux-proxy.ts): `src/sandbox/mux-proxy.ts`
- [Request filter](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/request-filter.ts): `src/sandbox/request-filter.ts`
- [Parent proxy](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/parent-proxy.ts): `src/sandbox/parent-proxy.ts`
- [TLS termination](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/tls-terminate-proxy.ts): `src/sandbox/tls-terminate-proxy.ts`
- [MITM certificates](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/mitm-ca.ts): `src/sandbox/mitm-ca.ts`

### Credentials and monitoring

- [Credential controls](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/credential-extract.ts): `src/sandbox/credential-extract.ts`
- [Body substitution](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/body-substitution.ts): `src/sandbox/body-substitution.ts`
- [Violation monitor](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/linux-violation-monitor.ts): `src/sandbox/linux-violation-monitor.ts`
- [Violation store](https://github.com/anthropic-experimental/sandbox-runtime/blob/main/src/sandbox/sandbox-violation-store.ts): `src/sandbox/sandbox-violation-store.ts`

### Other components

- **Caller**
- **Sandboxed process**
- **Remote network**

## Connections

- Caller → CLI: runs command
- CLI → Config loader: loads settings
- Config loader → Config schemas: validates config
- CLI → Sandbox manager: initializes sandbox
- Sandbox manager → macOS isolation: builds isolation
- Sandbox manager → Linux isolation: builds isolation
- Sandbox manager → Windows isolation: builds isolation
- CLI → Sandbox manager: wraps command
- CLI → Sandboxed process: spawns wrapped command
- Sandbox manager → Proxy mux: starts listeners
- Proxy mux → HTTP proxy: dispatches HTTP
- Proxy mux → SOCKS proxy: dispatches TCP
- HTTP proxy → Request filter: checks requests
- HTTP proxy → TLS termination: terminates TLS
- HTTP proxy → Parent proxy: forwards via parent
- TLS termination → Request filter: checks requests
- TLS termination → MITM certificates: mints certificates
- TLS termination → Body substitution: transforms bodies
- HTTP proxy → Remote network: forwards traffic
- SOCKS proxy → Remote network: forwards traffic
- TLS termination → Remote network: forwards HTTPS
- Sandbox manager → Violation monitor: enables monitoring
- Violation monitor → Violation store: records events
- Request filter → Credential controls: applies credential rules