Nexus (my FreeBSD 15.1 operator host) ran claude-code-2.1.89 from April 2026, 155 patch versions behind upstream. The upstream npm package @anthropic-ai/claude-code@2.1.266 ships no FreeBSD binary; npm install -g leaves a 500-byte stub that prints Error: claude native binary not installed. The FreeBSD port sidesteps this by running the Linux binary under linux_base-rl9 + Linuxulator. I built the upgrade path in a Bastille thin jail first, and hit an outbound-NAT gap in Bastille's default install along the way.

• Sandboxing AI Coding Agents with FreeBSD Jails — two-machine operator/sandbox architecture, ZFS quotas, rctl, per-jail credential scoping.
• FreeBSD Agent Sandboxing: Bastille, Capsicum, and Deno — keyless LiteLLM proxy pattern; benchmarked npm install claude-code at 30s native (jail) vs 16+ min via Linux emulation (Podman).
• Practical Agent Sandbox Configurations — tested Bastille /usr/local/etc/bastille/bastille.conf values on FreeBSD 15.0.

This post covers the packaging path on 15.1 and the pf.conf fix those designs assume.

Around 2.1.140, Anthropic transitioned @anthropic-ai/claude-code from a pure-JS package to a wrapper around per-platform native binaries. bin/claude.exe is a 500-byte error stub; the real binary comes down via a postinstall script keyed on optionalDependencies.

Platform matrix as of 2.1.266:

darwin-{arm64,x64}, linux-{arm64,x64}, linux-{arm64,x64}-musl,
win32-{arm64,x64}

Eight optionalDependencies, verified against the npm registry on 2026-09-09.

No freebsd-x64. So npm install -g @anthropic-ai/claude-code@2.1.266 on FreeBSD lands the stub, and postinstall leaves it in place:

Error: claude native binary not installed.

Either postinstall did not run (--ignore-scripts, some pnpm configs)
or the platform-native optional dependency was not downloaded
(--omit=optional).

The cli-wrapper.cjs fallback that would let Node execute cli.js directly is also gone from recent versions.

FreshPorts misc/claude-code sidesteps the problem by installing the Linux x86_64 binary and running it under Linuxulator:

• Runtime deps: bash, linux_base-rl9 > 9.2=
• Requires linux_enable=YES and fdescfs mounted at /compat/linux/dev/fd with linrdlnk
• Runs on the same abstract memory model as native FreeBSD processes; no VM, no container runtime

Repositories and versions at time of writing (2026-09-09):

The latest pkg builder lags npm by ~40 patch versions. That's the gap between available and current, which matters for feature-gated model targets. The claude-fable-5 model shipped earlier in the 2.1.x line and resolves via the fable alias in builds that predate the 5.1 revision. The 5.1 revision claude-fable-5-1 was added in claude-code-2.1.257; the fable alias then resolves to it on any host running 2.1.257 or later. The alias itself is stable across versions; only the target model it points to is gated.

Bastille was already provisioned on nexus (zfs backend, bastille0 loopback interface, one existing agent-session-01 jail on 15.0). To test the upgrade against 15.1 specifically:

sudo bastille bootstrap 15.1-RELEASE update    # 372 MB base
sudo bastille create claude-test 15.1-RELEASE 10.0.0.20

Bastille writes a "thin" jail: the release is mounted read-only via A NullFS mount at root/.bastille, plus symlinks under /bin, /usr, etc. point into it. The per-jail ZFS dataset holds only the delta.

Because the freshly booted jail had no outbound (see next section), the canonical bastille pkg claude-test install path failed with pkg: Error fetching ... Operation timed out. Workaround: run pkg from the host with -c chroot pointing at the jail's root filesystem. pkg uses the host's network, DNS, and repo config, but installs into the chroot's package DB and file layout.

sudo pkg -c /usr/local/bastille/jails/claude-test/root install -y \
  linux_base-rl9 claude-code

Downloads ~115 MB, installs in ~30s. Result:

[claude-test]:
2.1.204 (Claude Code)

That's the quarterly repo version. To reach 2.1.225 (which recognizes the fable model alias), add a latest overlay:

sudo tee /usr/local/etc/pkg/repos/FreeBSD-latest.conf <<'EOF'
FreeBSD-latest: {
  url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest",
  mirror_type: "srv", signature_type: "fingerprints",
  fingerprints: "/usr/share/keys/pkg", enabled: yes, priority: 5
}
EOF

# pkg -c uses the CHROOT's repos dir, so copy the overlay in too
sudo mkdir -p /usr/local/bastille/jails/claude-test/root/usr/local/etc/pkg/repos
sudo cp /usr/local/etc/pkg/repos/FreeBSD-latest.conf \
        /usr/local/bastille/jails/claude-test/root/usr/local/etc/pkg/repos/

sudo pkg -c /usr/local/bastille/jails/claude-test/root install \
     -r FreeBSD-latest -y claude-code

Result:

[claude-test]:
2.1.225 (Claude Code)

$ claude --help | grep -A1 -- --model
  --model <model>   Model for the current session. Provide
                    an alias for the latest model (e.g.
                    'fable', 'opus', or 'sonnet') or a
                    model's full name (e.g. 'claude-fable-5').

With the jail booted and claude installed, launching the TUI inside a tmux pane rendered the startup screen, then hung on network:

 Unable to connect to Anthropic services
 Connection to api.anthropic.com timed out after 10 seconds

Diagnosis. Bastille populates the <jails> pf table with every jail's IP at start:

$ sudo pfctl -t jails -T show
   10.0.0.10      # agent-session-01
   10.0.0.20      # claude-test

But nexus's /etc/pf.conf, installed when Podman was set up, only translates <cni-nat>, not <jails>:

# PF config for podman container networking
v4egress_if = "re0"

nat on $v4egress_if inet from <cni-nat> to any -> ($v4egress_if)
rdr-anchor "cni-rdr/*"
nat-anchor "cni-rdr/*"
table <cni-nat> persist

Bastille sets up the table on its side and assumes an operator-owned pf.conf will reference it. On a fresh install that isn't the case.

Additive change to /etc/pf.conf:

 # PF config for podman container networking
 v4egress_if = "re0"

 nat on $v4egress_if inet from <cni-nat> to any -> ($v4egress_if)
 rdr-anchor "cni-rdr/*"
 nat-anchor "cni-rdr/*"
 table <cni-nat> persist
+
+# Bastille jails on bastille0 (10.0.0.0/24) — table populated by bastille at jail start
+nat on $v4egress_if inet from <jails> to any -> ($v4egress_if)
+table <jails> persist

Apply:

sudo cp /etc/pf.conf /etc/pf.conf.pre-jails-nat.$(date +%Y%m%d)
# edit /etc/pf.conf per above
sudo pfctl -nf /etc/pf.conf     # dry-run parse — must exit 0
sudo pfctl -f  /etc/pf.conf     # load

Verify from inside jail:

$ sudo jexec claude-test /bin/sh -c 'nc -z -w 3 api.anthropic.com 443 && echo OK'
Connection to api.anthropic.com 443 port [tcp/https] succeeded!
OK

The above unlocks all outbound from any Bastille jail: fine for a smoke test, not the target state. The keyless proxy pattern applies: jail reaches LiteLLM only; secrets live outside the jail.

Adjacent to the packaging path but worth capturing. On nexus the loader config had two directives mashed onto one line without a newline:

vfs.zfs.arc_max="8589934592"kern.racct.enable=1

Silently broke both. sysctl vfs.zfs.arc_max reported 0 (unbounded; ARC grew to ~half of RAM, competing with the jail for memory), and sysctl kern.racct.enable reported 0 (RACCT/RCTL not active, so rctl -a jail:<name>:memoryuse:... etc. are all no-ops, so you can neither cap nor explicitly grant the jail an envelope).

Fixed by splitting onto two lines. Important operational note: this is a latent change. /boot/loader.conf is read only at boot, so the running system is unaffected until the next restart. Verify post-reboot:

sysctl vfs.zfs.arc_max kern.racct.enable
# expected: 8589934592 and 1 respectively

Only after that does the following work. The reason to care is being able to explicitly grant resources to a jail, not just constrain them:

# post-reboot, jail is on the record for 8 GB RAM + all 4 cores
sudo rctl -a jail:claude-test:memoryuse:deny=8G
sudo rctl -a jail:claude-test:pcpu:deny=400
sudo rctl -l jail:claude-test

Concatenated loader.conf directives fail silently: no error, no warning, wrong sysctl values on next boot. Verify with sysctl after any RACCT change.

The pattern is not FreeBSD-specific: a host-owned secrets directory, read-only bind-mounted into the sandbox, with a credential helper that reads from the mount point. On Linux the same shape lands as systemd-nspawn --bind-ro, bwrap --ro-bind, or docker run --secret. On macOS it's App Sandbox with a mount-scope entitlement pointing at a host-owned directory. On Kubernetes it's a projected ServiceAccount token injected via serviceAccountToken volume projection with readOnly: true. All four preserve the same three properties as the nullfs mount here: rotation is a host-side operation on the source file, the sandbox can read but not write, and revocation removes the credential from every mount that references it. The mechanism differs; the operator model doesn't.

Follow-up beads (will file when bd is rebuilt with CGO on nexus):

• [ ] Move the current permissive nat on … from <jails> to the default-deny allowlist above, once LiteLLM auth is provisioned for jail identities.
• [ ] Move nexus pkg upgrade claude-code from 2.1.89 to 2.1.204 on the host once the same procedure is smoke-tested in this jail with Fable calls actually going through.
• [ ] Add the pf <jails> NAT rule as a checked-in template so any fresh nexus/hydra bastille setup lands with jails routable by default, or ship it with default-deny + LiteLLM allowlist from the start, which is probably the right posture.
• [ ] Poudriere build of misc/claude-code at ports HEAD (2.1.266) for the Fable 5.1 model (claude-fable-5-1), since FreeBSD-latest is stuck at 2.1.225.
• [ ] Reboot nexus to reap a wedged 26-day-old find(1) (R< state, refused SIGKILL) that was holding 13.7 GB VSZ and pinning swap at 100%. Post-reboot, redo the storage baseline.

Once the jail is up (persists across host session restarts because Boot=on):

# List jails, confirm claude-test is Up
sudo bastille list all

# Interactive shell in jail (three options)
tmux attach -t claude-jail                  # if a persistent session exists
sudo jexec claude-test /bin/sh              # fresh
sudo bastille console claude-test           # via bastille wrapper

# One-shot
sudo bastille cmd claude-test claude --version

# 0. Prereqs (idempotent; skip if already set)
sudo pkg install -y bastille linux_base-rl9
sudo sysrc bastille_enable=YES linux_enable=YES
sudo sysrc -f /usr/local/etc/bastille/bastille.conf \
    bastille_zfs_enable=YES bastille_zfs_zpool=zroot
sudo service linux onestart
sudo service bastille onestart

# 1. pf: add jails NAT rule (see body of post)
sudo vi /etc/pf.conf
sudo pfctl -nf /etc/pf.conf && sudo pfctl -f /etc/pf.conf

# 2. Bastille base + jail
sudo bastille bootstrap 15.1-RELEASE update
sudo bastille create claude-test 15.1-RELEASE 10.0.0.20

# 3. Stop jail, add allow.mount.* + linux mounts (see body of post)
sudo bastille stop claude-test
sudo vi /usr/local/bastille/jails/claude-test/jail.conf
sudo vi /usr/local/bastille/jails/claude-test/fstab
sudo mkdir -p /usr/local/bastille/jails/claude-test/root/compat/linux/{proc,sys,dev/shm}
sudo bastille start claude-test

# 4. Install claude-code from FreeBSD-latest overlay
sudo tee /usr/local/etc/pkg/repos/FreeBSD-latest.conf <<'EOF'
FreeBSD-latest: {
  url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest",
  mirror_type: "srv", signature_type: "fingerprints",
  fingerprints: "/usr/share/keys/pkg", enabled: yes, priority: 5
}
EOF
sudo mkdir -p /usr/local/bastille/jails/claude-test/root/usr/local/etc/pkg/repos
sudo cp /usr/local/etc/pkg/repos/FreeBSD-latest.conf \
        /usr/local/bastille/jails/claude-test/root/usr/local/etc/pkg/repos/
sudo pkg -c /usr/local/bastille/jails/claude-test/root install \
     -r FreeBSD-latest -y linux_base-rl9 claude-code

# 5. Enable Linuxulator inside jail
sudo bastille sysrc claude-test linux_enable=YES
sudo bastille service claude-test linux start

# 6. Smoke test
sudo bastille cmd claude-test claude --version

Total wall time: ~10 minutes including base bootstrap. Reproducible.

Testing the same pattern on hydra, a FreeBSD 14.4-RELEASE-p6 host used for ADS-B/AIS/AMR signal processing. Unlike nexus (15.1), hydra runs claude via npm install rather than the FreeBSD port.