diff --git a/sandbox/Dockerfile b/sandbox/Dockerfile
index bb79d35..cafae20 100644
--- a/sandbox/Dockerfile
+++ b/sandbox/Dockerfile
@@ -13,6 +13,22 @@ ARG CLAUDE_CODE_VERSION=2.1.114
 USER root
 RUN npm install -g "@anthropic-ai/claude-code@${CLAUDE_CODE_VERSION}" \
     && claude --version
+
+# bubblewrap + socat are the Linux backends for Claude Code's built-in
+# `/sandbox` feature. Without them, Claude falls back to unsandboxed bash —
+# our managed-settings.json sets failIfUnavailable=true so that silent
+# degradation becomes a hard error instead.
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends bubblewrap socat \
+    && rm -rf /var/lib/apt/lists/*
+
+# Managed (enterprise) settings live at the system-wide path and take
+# precedence over per-user and per-project settings. This is how we pin
+# Bash egress + WebFetch allowlists: users can extend via their own
+# settings, but cannot downgrade these rules.
+COPY managed-settings.json /etc/claude-code/managed-settings.json
+RUN chmod 0644 /etc/claude-code/managed-settings.json
+
 COPY cleanup.sh /opt/cleanup.sh
 RUN chmod +x /opt/cleanup.sh
 USER user
diff --git a/sandbox/managed-settings.json b/sandbox/managed-settings.json
new file mode 100644
index 0000000..167b771
--- /dev/null
+++ b/sandbox/managed-settings.json
@@ -0,0 +1,35 @@
+{
+  "sandbox": {
+    "enabled": true,
+    "failIfUnavailable": true,
+    "allowUnsandboxedCommands": false,
+    "allowManagedDomainsOnly": true,
+    "enableWeakerNestedSandbox": true,
+    "network": {
+      "allowedDomains": [
+        "pypi.org",
+        "files.pythonhosted.org",
+        "registry.npmjs.org",
+        "github.com",
+        "api.github.com",
+        "raw.githubusercontent.com",
+        "objects.githubusercontent.com",
+        "codeload.github.com",
+        "anthropic-proxy"
+      ]
+    }
+  },
+  "permissions": {
+    "deny": [
+      "WebFetch"
+    ],
+    "allow": [
+      "WebFetch(domain:github.com)",
+      "WebFetch(domain:raw.githubusercontent.com)",
+      "WebFetch(domain:docs.anthropic.com)",
+      "WebFetch(domain:code.claude.com)",
+      "WebFetch(domain:pypi.org)",
+      "WebFetch(domain:registry.npmjs.org)"
+    ]
+  }
+}