# Fence

A lightweight, container-free sandbox that wraps commands to block network access by default and restrict filesystem operations by configurable rule, and doubles as a permission manager for AI coding agents.

Fence wraps a command in a sandbox that blocks all network access by default and restricts filesystem operations according to configurable rules, aimed at running semi-trusted code such as package installs, build scripts, CI jobs or an unfamiliar repository with controlled side effects. Named templates can allow specific categories of network access, such as one that permits common package registries, and command deny rules can block specific dangerous commands outright.

Beyond sandboxing arbitrary commands, Fence works as a permission manager for coding agents, including Claude Code, Codex, Amp, Gemini CLI, GitHub Copilot, OpenCode and Factory's Droid CLI, giving them a layer of defense in depth beyond their own built-in permission systems. Configuration is read from a settings file that can be named explicitly or discovered automatically.

On Linux it additionally needs bubblewrap for sandboxing and socat for network bridging, with optional bpftrace support for observing filesystem rule violations; it also installs through Homebrew or Nix on macOS and Linux. It is written in Go and released under the Apache-2.0 license.

Website: https://fencesandbox.com/docs