The docs seem to suggest using alternate approaches.
> Modern systems provide more secure ways to implement a restricted environment, such as jails, zones, or containers.
https://www.gnu.org/software/bash/manual/html_node/The-Restr...
> Does that work? I've never seen it used. It seems easy to escape.
Yes, it does work for its intended purpose. It has often been used in combination with chroot[0] as well.
> The docs seem to suggest using alternate approaches.
>> Modern systems provide more secure ways to implement a restricted environment, such as jails, zones, or containers.
These approaches are not mutually exclusive with restricted shell use. For example, one could use FreeBSD jails to secure Apache httpd and/or Nginx and still employ a restricted shell to evaluate requests.
0 - https://man.freebsd.org/cgi/man.cgi?query=chroot&apropos=0&s...
Bash restricted mode needing a chroot may suggest that Claude also needs a chroot (or restricted file permissions, jail, etc).
I believe running coding agents within a jail/container is a "best practice" to limit their blast radius. At least, this is what people I respect have conveyed to me.
A sibling comment I can't reply to asks if you can do with with unix permissions.
These were really intended for anonymous guest access, or at least often used for this purpose. You couldn't do the same things with the file permissions systems at the time.