Integrating sandboxes into native apps

You already have an app you like talking to your agent in. It might be Claude Desktop, ChatGPT Desktop, Cursor, or anything else your team standardized on. Fortunately, it isn’t difficult to configure these to leverage an agent running inside a sandbox, giving you the comfort of the app with the security of the sandbox.

The process is simple - configure the native app to connect to a sandbox using SSH, as if it were a remote machine running the agent harness.

In this guide, you’ll learn how to connect Claude Desktop and ChatGPT Desktop. VS Code, Cursor, and a few other editors connect the same way.

It’s SSH under the hood

There’s no special protocol here or plugin doing anything clever. A sandbox exposes itself over SSH, and any app with “remote” or “SSH” support can connect to it. The desktop app doesn’t know it’s talking to a sandbox. It think’s it’s just a remote host with a shell and a filesystem.

The process is straight forward:

0. Run the one-time setup to configure your machine’s SSH config
1. Create the sandbox
2. Configure the client to connect to the sandbox using SSH
3. Do your work

One-time setup

Before any app can connect, your machine needs an SSH client that knows how to find sandboxes by name. Run this once:

$ sbx setup ssh

It starts the Docker Sandboxes daemon and writes a managed block into your SSH config (~/.ssh/config on macOS/Linux, %USERPROFILE%\.ssh\config on Windows).

If you’re curious, here’s what gets written:

# >>> docker sandboxes (managed) >>>
Host *.sbx
    User _default_user_
    ProxyCommand "sbx" ssh proxy %n
    IdentityAgent none
    IdentityFile /dev/null
    IdentitiesOnly yes
    ControlMaster no
    ControlPath none
    UserKnownHostsFile "~/.ssh/sbx_known_hosts"
    KnownHostsCommand "sbx" ssh known-hosts %H
    StrictHostKeyChecking yes
# <<< docker sandboxes (managed) <<<

The Host *.sbx wildcard is what lets you reach any sandbox by name. When the SSH connection is created, the ProxyCommand config routes the connection through the local daemon instead of a network port.

Connect Claude Desktop to a sandbox

Create a named sandbox using the Claude agent type:

$ sbx create --name demo claude .

Confirm it’s reachable before involving the desktop app:

$ ssh demo.sbx

If that drops you into a shell, you’re ready.

In Claude Desktop:

1. Open the environment drop-down.
2. Select + Add SSH connection.
3. Give the connection a name.
4. In the SSH Host field, enter the sandbox’s hostname — demo.sbx for the sandbox created above.
5. Leave SSH Port and Identity File blank. The managed SSH config handles both.

Once the connection exists, select it from the environment drop-down and use the remote folder picker to choose your workspace. It may open at /home/agent rather than the folder you expect. You will likely need to navigate to the path your project is mounted.

On Windows specifically, timeouts here are usually a missing sh.exe. Check with where.exe sh in PowerShell, and if nothing comes back, install Git for Windows and add C:\Program Files\Git\bin to your user PATH. Restart Claude Desktop afterward — it only reads PATH at launch.

Connect ChatGPT Desktop to a sandbox

The shape of this is identical, with two differences: the sandbox uses the Codex template, and permissions are a separate step.

Start by creating a sandbox:

$ sbx create --name demo codex .

Verify you can connect to it using ssh:

$ ssh demo.sbx

Configure ChatGPT Desktop to connect to the sandbox:

1. Go to Settings > Connections
2. In the SSH tab, add a manual SSH connection using demo.sbx as the host

When you’re ready to start a session, use the remote folder picker to set the mounted workspace as the project directory.

By default, ChatGPT asks approval before the agent runs anything. Since the sandbox is already the isolation boundary, those prompts add friction without adding protection. You can turn off the prompts per conversation from the permissions menu by selecting Full access.

If prompts keep appearing after selecting Full access, update the desktop app. There is a known sync issue between the app and remote tasks. Restarting the active task, or reconnecting entirely, usually clears it.

Connecting other apps to sandboxes

VS Code, Cursor, and T3 Code connect the same way - connect a sandbox using the remote-SSH feature built into the apps.