So, I- I was out in the shed the other night, right, trying to get Claude Code to
spin up a global npm package inside a dev container, and- mate,
it was like hitting a brick wall.
This classic...
double-sandbox headache.
Oh, yeah.
Because if you're already running inside Docker or a GitHub Actions runner,
you've already got isolation.
Then Claude tries to spin up its *own* sandbox on top of that,
and suddenly...
And suddenly it-it-it can't write to ~/.kube or run a simple global tool install
without throwing a massive fit about permissions.
But- but here's the thing.
If you turn the sandbox completely off, you lose all the guardrails.
A rogue package dependency could just- zip!-exfiltrate your .ssh keys or AWS
credentials to some random IP in the middle of the night.
Exactly.
The network egress control is the actual lifesaver there.
But in this new v2.1.216 release, they've finally decoupled them.
They introduced this new setting...
uh, sandbox.filesystem.disabled.
sandbox.filesystem.disabled.
Yeah, you just- you just chuck that nested JSON key into your global
~/.claude/settings.json, or even your local project config.
It completely skips the local filesystem isolation-so no more messing around with
endless allowWrite arrays-but it keeps the built-in proxy server running.
Right, so Claude can write freely to your local system, but the moment a sketchy
script tries to ping some external domain to dump your credentials,
the network block still catches it.
It's the perfect middle ground for dev containers.
Exactly!
Spot on.
Now, the- the other thing that was absolutely killing me on long sessions was this-
this massive lag.
Like, you're fifty turns deep into debugging a gnarly state issue,
and suddenly every single command takes...
I don't know, three, four seconds just to respond.
That was the quadratic slowdown in the message normalization process.
Basically, every single turn you took, the CLI had to- to normalize the entire
history, and that cost scaled quadratically with the number of turns.
So fifty turns in, it's doing a mountain of redundant work.
Yeah, it-it-it was flat out painful.
But they've flattened that cost in 2.1.216.
The resume times now are...
well, they're snappy again.
No more making a cuppa while the terminal thinks about its life choices.
Well, and there's one more fix in this patch that is honestly a huge deal for
safety.
It's how they handle the AskUserQuestion tool.
Ah, the rogue agent drift.
I've had this happen!
Claude asks a question, and I type something like, "Hold on,
let me double-check that," and the parser somehow thinks...
--thinks you said "yes" or gave approval to proceed!
It would just run wild.
Now, they've wrapped those free-text user answers in neutral phrasing wrappers.
So when you say "Wait" or "Hold on," the model actually registers it as a stop and
waits for you, instead of drifting off into executing code you didn't approve.
Which is massive when you're letting an agent loose on your codebase.
Alright, I'm gonna go update my global config right now.
Do it.
See ya.