Sanboxed Claude Code

In case anyone cares about it, you can run Claude inside a container if you want to make sure to only give it the context of the codebase on which you're currently working, not your whole OS.

This isn't news, nothing that I'll post here is gonna be blowing anyone's mind, I simply want to share my take on specific topics.

1. 
   

   Create your own sandbox image. Dockerfile shown here for reference, but can be whatever suits you as long as it has npm for installing Claude:
   
   

   
   

   FROM node:24-alpine
   
   
   
   # Create a non-root user to run the code
   
   RUN adduser -D claude
   
   
   
   # Install Node.js and npm (as root)
   
   RUN apk update && \
   
       apk add nodejs npm && \
   
       rm -rf /var/cache/apk/*
   
   
   
   # Install claude-code globally (as root)
   
   RUN npm install -g @anthropic-ai/claude-code
   
   
   
   # Set the working directory
   
   WORKDIR /workspace
   
   
   
   # Give the non-root user ownership of the workspace directory
   
   RUN chown -R claude:claude /workspace
   
   
   
   # Switch to the non-root user
   
   USER claude
   
   
   
   # Default command to run when the container starts
   
   CMD ["sh"]
   
   

   
   
   


2. 
   

   Run an ephemeral container that has access to your current workdir:
   
   

   
   

   docker run -it --rm -v $(pwd):/workspace:rw claude-sandbox
   
   

   
   
   
   

   In here, /workspace matches what you define as WORKDIR in the Dockerfile.

   
   


3. 
   

   (Optional) Create an alias by adding this to your .bashrc or .zshrc:
   
   

   
   

   alias claude-sandbox='docker run -it --rm -v $(pwd):/workspace:rw claude-sandbox'
   
   

   
   
   

That's it. You're not gonna have to worry about AI going rogue and messing up your whole system just because you got too deep into "vibe coding" and told Claude to do anything it wanted as long as your weekend project ended up working fine.