Claude Code sandbox: commands fail with 'Operation not permitted' or 'Read-only file system', or a network call is blocked ('Could not resolve host'). How do I allow the path, domain or command safely without disabling the sandbox?

Cause: When the Claude Code Bash sandbox is enabled, shell commands run inside an OS-enforced boundary (Seatbelt on macOS, bubblewrap on Linux and WSL2). By default writes are limited to the working directory, the per-user temp directory and added directories, and there is no direct network route: traffic goes through a proxy that only allows hosts listed in sandbox.network.allowedDomains, which starts empty. Filesystem failures show up as 'Operation not permitted' on macOS or 'Read-only file system' on Linux/WSL2. For a blocked network call the result names the denied host. Fix (narrowest first): 1. Missing path: add it to sandbox.filesystem.allowWrite in settings, for example "allowWrite": ["~/.kube", "/tmp/build"]. Sandbox paths use normal conventions (absolute /path, home-relative ~/path), which differs from the //path form used in Read/Edit permission rules. 2. Missing host: add only the hosts you need to sandbox.network.allowedDomains, for example ["github.com", "*.npmjs.org"]. Use deniedDomains to keep a host blocked even when a wildcard would allow it. 3. A tool that cannot work inside the sandbox at all (the docs give docker as an example): add a specific pattern to sandbox.excludedCommands, such as "docker compose *". Matching is on the command text, every command in a chain must match, and a script that calls docker internally will not match. Excluded commands still go through the normal permission flow, but they run with no filesystem restriction and no network proxy, so keep the pattern narrow. 4. Do not rely on the model retrying with dangerouslyDisableSandbox. If you want that escape hatch closed, set "allowUnsandboxedCommands": false. Set "failIfUnavailable": true if you want Claude Code to refuse to start rather than silently run unsandboxed when the sandbox cannot run. 5. Remember scope: the file tools, WebFetch, WebSearch, MCP servers and hooks run outside the sandbox and are governed by permission rules instead. In permission rules, deny is evaluated first, then ask, then allow, and an allow rule cannot carve an exception out of a deny rule. Verify: Rerun the failing command through Claude (not at the unsandboxed ! prompt). A write outside allowed paths such as touching a file in your home directory should still fail, and a request to a host not in allowedDomains should still fail, while the one you added now succeeds. Sources: https://code.claude.com/docs/en/sandboxing https://code.claude.com/docs/en/permissions