Terminal Sandbox

Run agent shell commands in an isolated environment that protects your workstation.

Overview

Antigravity includes a Terminal Sandbox that isolates shell commands executed by agents. Sandboxed commands can write to your project folders, temp directories, and common build caches, and read system directories like /usr and /etc so your tools keep working. Sensitive files like ~/.ssh and .env are blocked, anything not explicitly mounted is invisible inside the sandbox, and network access is limited to domains you’ve approved.

The sandbox is built on native operating system primitives, so there are no virtual machines or Docker images to manage and no startup delay:

Operating System	Technology	Details
Linux	Namespaces	Kernel namespaces isolate the filesystem, hide host processes, and cut off networking.
macOS	`sandbox-exec`	Seatbelt profiles (SBPL) restrict filesystem access and socket connections.

Configuration

You can configure the sandbox globally or per project.

Global settings

In Settings > General, under Agent Settings:

Enable Sandbox Mode (Preview): Runs agent terminal commands inside the sandbox.
Terminal Command Auto Execution: Set to Proceed in Sandbox to let sandboxed commands run without approval; commands that need to run outside the sandbox still ask first. The other options are Require Review and Always Proceed.

Project settings

Select a project under Settings > Projects to override these settings for that project. Each setting gains an Inherit General option, and Enable Sandbox Mode becomes a dropdown: Inherit General, Enabled, or Disabled.

Security presets

The Security Preset dropdown in the same settings section bundles the terminal and file access policies:

Preset	Terminal Command Auto Execution	Outside-of-folders file access
Default	Require Review	Always Ask
Full machine	Require Review	Allow
Turbo mode	Always Proceed	Allow

None of the presets turn the sandbox on. Enabling Enable Sandbox Mode switches the preset to Custom, where you set each option yourself — a common combination is the sandbox with Proceed in Sandbox.

Unsandboxed commands

When a command needs to run outside the sandbox—because it matches an unsandboxed(...) rule, the agent requested it, or the sandbox is disabled—the command runs on your host with full privileges. Depending on your execution policy, the agent pauses for your approval first.

Permissions integration

The sandbox derives its access boundaries from your Permissions configuration:

Filesystem: Your project folders are mounted read-write. Paths allowed under read_file are mounted read-only, and paths allowed under write_file are mounted read-write, on top of the default system mounts. Everything else is inaccessible.
Network: When network access is enabled, domains allowed under read_url are added to the sandbox’s outbound allowlist.
Escape hatches (unsandboxed): To let specific commands run outside the sandbox without disabling it entirely, add an unsandboxed allow rule:
```
unsandboxed(git push)
unsandboxed(docker compose .*)
```