Going from a single process up to a microVM, one layer at a time. Each layer stops some problems and not others. The page is built around one setup: a container running several claude subprocesses. Source: Hosting the Agent SDK and anthropics/sandbox-runtime.
Purpose
Learn the terms well enough to explain them in a blog post or interview, and to choose an isolation setup when deploying Schoolspy.
Done when you can answer
In one SDK session, which process owns the shell, the working directory, and the transcript?
With 10 users in one container, which layer stops A from reading B's files?
Which layers does each of the four session patterns need, and why?
Depth
4 views, about 15 minutes. Answer the exercises to check off the questions.
View 1 · answers Q1
One container, many subprocesses
Step 1 / 9
View 2 · answers Q2
Which layer stops which problem
All the layers are compared against the same seven problems. Tick a layer to add it to your setup; the bottom row shows which problems are still open. Hover over or tap a cell to see why.
Try
Tap any cell.
✓ stops it by defaultcfg stops it only if configured½ partly· does not help
A gap no layer covers: the agent sends your data to a domain you allowed, such as a gist on github.com. Domain allowlists assume an allowed site can't receive stolen data. When that assumption fails (prompt injection), the fix is narrower tool permissions, not a stronger sandbox.
View 3 · answers Q3
Why each layer exists
Each design choice on the right is there because of facts on the left. Untick a fact and every choice that depended on it fades out. Use the pattern buttons to load the facts that hold for each of the four session patterns.
Pattern
Facts (constraints)
Choices they force
View 4 · checks Q1–Q3
Predict, then reveal
Reference
Glossary
Running things
process
A running program, with its own memory and a PID.Your FastAPI app is one.
subprocess
A process started by another process.query() starts a claude subprocess.
process tree
Parents and children: app → claude → bash → git.One session = one branch of the tree.
stdio
The stdin/stdout pipes between a parent and its child.How the SDK talks to claude. No network port.
cwd
Working directory: the folder a process treats as "here."Just a starting point. cd .. still works.
Limiting things
sandbox
Any setup that runs code with restricted access. A goal, not a product.
namespace
Linux feature that gives a process its own view of something (files, network, PIDs).
cgroup
Linux feature that caps how much CPU and RAM a group of processes can use.
seccomp
Linux feature that blocks specific system calls.
container / image
Namespaces + cgroups + a packaged filesystem. The image is the template; the container is a running copy of it.Shares the host kernel.
gVisor · Firecracker · VM
gVisor intercepts system calls with a kernel written in user space. Firecracker and VMs boot their own guest kernel.
Agent-hosting words
srt (sandbox-runtime)
Fences one command and all its children: limits on writes, reads and network. Uses bubblewrap on Linux and Seatbelt on macOS.Writes and network denied by default; reads allowed by default.
egress / proxy
Egress is outbound traffic. A proxy is the middleman that checks every request against an allowlist.
multi-tenant
One container or host serving several users ("tenants").
ephemeral
Thrown away when stopped. Container disk is ephemeral by default.
SessionStore
SDK adapter that copies transcripts to durable storage.Transcripts only, not CLAUDE.md or artifacts.
Talk back
Ask a follow-up
Views you marked unclear
None yet. Use "Mark unclear" on any view.
Re-explain it in your own words
Stop here when all three questions in the header have a check mark. The next topic, if you want one, is actually running srt inside Docker (bubblewrap needs user namespaces, which Docker restricts by default). That's an implementation detail, not vocabulary.