Local sandboxing in the GitHub Copilot app
By Steven Van ·
Per-project settings in the GitHub Copilot app can now restrict agent-run commands' access to files, networks, and credentials.
The GitHub Copilot app can now run agent-invoked commands inside an operating-system sandbox that limits what they can touch on your machine. It works for local repository and working tree sessions, though not for cloud sandbox sessions or sessions on a remote host.
Sandboxing is off by default and is configured per project in the app's settings. For each project, you can set:
- Filesystem: additional read/write folders, additional read-only folders, and folders that are denied entirely
- Network: whether outbound internet and local network connections are allowed
- Credentials: whether Git credentials (for authenticated HTTPS operations) and GitHub CLI credentials are available inside the sandbox
These settings describe the policy the app requests when a sandboxed session starts; an enterprise-managed policy can be more restrictive. If the operating system can't enforce the requested policy, the sandboxed shell fails with an error instead of running unsandboxed. Turning sandboxing on applies to new sessions in the project, not ones already running, though the /sandbox on and /sandbox off commands can change an active session. Local sandboxing in the GitHub Copilot app is in public preview and subject to change, per the announcement.
