I've been developing my own sandboxing environment using Nvidia's Openshell.

Works like Claude code but with stronger guarantees for me on file system and network access. Still playing around with it, but so far I've been liking the setup.

I still run the sandbox inside a VM for now, but I feel far more comfortable in running Claude Code in unsupervised mode because I restrict the outbound network access and secrets never hit inside the sandbox.