Add sandbox mode to restrict Copilot CLI file access to a specified working directory

[rexxiang]

Describe the feature or problem you'd like to solve

Please add a sandbox capability to copilot-cli that constrains the code agent’s filesystem permissions so it can only read/write within a specified working directory (workspace root), and is prevented from accessing or modifying any paths outside that directory. This should be similar in spirit to the sandbox/workspace isolation provided by tools like Codex and Claude Code.

Proposed solution

• Add an opt-in flag and/or config, e.g. --sandbox, --workspace , or sandbox=true
• When enabled:
  • All file reads/writes are allowed only under the workspace root (including subdirectories)
  • Block path traversal (..), absolute paths, and symlink escapes that would resolve outside the workspace, with a clear error message
• (Optional) Support an allowlist for explicitly permitted additional directories (e.g., temp/cache)

Example prompts or workflows

No response

Additional context

https://github.com/anthropic-experimental/sandbox-runtime

[qin-guan]

It would be great to have this feature or more documentation from the team about the guardrails available currently to prevent errant LLM access / privileges 🧐 especially when similar products (Codex/CC) have them as well. It is a little unsettling that Copilot has access to my entire drive

[rexxiang]

Just checking, any updates on this?

[real-or-random]

As for external projects, there's https://github.com/GordonBeeming/copilot_here and https://www.docker.com/products/docker-sandboxes/ but the latter doesn't work on Linux.

[mpostelnicu]

any plan to implement this? both gemini cli and claude code support sandboxing. it would be great to have this in copilot too.

[Starefossen]

We built cplt to address this. It wraps Copilot CLI in a macOS Seatbelt sandbox (sandbox-exec) with deny-by-default filesystem rules, enforced by the kernel.

What it restricts:

• File read/write limited to the project directory
• SSH keys, cloud credentials, .env files blocked
• Environment variables sanitized (only safe allowlist passes through)
• Network restricted to port 443
• npm/yarn lifecycle scripts blocked

brew install navikt/tap/cplt && cplt --shell-install — then typing copilot runs the sandboxed version.

macOS only (Seatbelt is a kernel feature). Would still love to see this built into Copilot CLI natively for cross-platform support.