Enable the Grok Build sandbox for filesystem and network limits

The sandbox limits what the agent process and its children can read, write, and reach on the network (Landlock on Linux, Seatbelt on macOS). It is off by default. Permissions gate whether a tool call runs; the sandbox limits what an approved call can do — see Configure Grok Build permissions.

Profiles

Profile	Filesystem read	Filesystem write	Child network	Use case
off	Unrestricted	Unrestricted	Allowed	No sandbox (default)
workspace	Everywhere	CWD, ~/.grok/, temp	Allowed	Normal development
devbox	Everywhere	Top-level dirs except /data	Allowed	Cloud devbox environments
read-only	Everywhere	~/.grok/ and temp only	Blocked	Code review, auditing
strict	CWD and system paths	CWD, ~/.grok/, temp	Blocked	Untrusted repositories

Limitation	Detail
Child network	Enforced on Linux only; no-op on macOS for read-only / strict
Credentials	Built-ins do not permanently protect paths such as ~/.ssh; use a custom deny list
~/.grok/	Stays writable under sandboxed profiles so sessions can persist
In-process network	Model API and web tools are not blocked by child-network settings

Turn a profile on

Mechanism	Example
CLI	grok --sandbox workspace
Config	[sandbox] profile = "workspace" in ~/.grok/config.toml
Env	GROK_SANDBOX=workspace
Managed pin	requirements.toml (can override CLI) — Enterprise

[sandbox]
profile = "workspace"
auto_allow_bash = false

auto_allow_bash = true skips bash permission prompts while a sandbox profile is active (settings reference). Start with workspace for day-to-day coding; move to read-only for audit passes and strict for untrusted trees.

Custom profiles

Define named profiles in ~/.grok/sandbox.toml or project .grok/sandbox.toml:

[profiles.my-profile]
extends = "workspace"
restrict_network = true
deny = ["/secrets", "**/.env", "**/*.pem"]

Select with --sandbox my-profile or [sandbox] profile = "my-profile". Built-in names cannot be redefined for selection. Extra fields include read_only, read_write, and kernel-enforced deny globs (entries with *, ?, or [). On Linux, read-deny with a non-empty deny list may require bubblewrap.

For untrusted trees, pair a strict profile with narrow permission allows (or headless dontAsk under Enterprise). Keep deny globs for secrets next to permission deny rules and PreToolUse hooks.

Pitfalls

• Child-network blocks apply on Linux; on macOS, read-only / strict still limit the filesystem while child network stays a no-op.
• ~/.ssh needs an explicit custom deny entry if you want it blocked.
• Install the CLI first: Install the Grok Build CLI.