claude-sandbox

Run Claude Code, Codex or Pi in a container with isolated credentials, limited writable paths and a network jail.

On a Linux host with uv and rootless Podman:

uv tool install claude-sandbox
cd ~/src/my-project
claude-sandbox

The launcher creates the container and starts sandboxed Claude. No clone or devcontainer setup is needed. Getting started covers prerequisites, login and verification. Already have a project devcontainer? Install into it.

How the documentation is structured

Tutorials

Guided lessons that take you from nothing to a working sandbox.

• Tutorials
  • Getting started
  • Set up a devcontainer for your project

How-to Guides

Focused recipes for specific tasks you already have in mind.

• How-to Guides
  • Installation and upgrades
    • Use the prebuilt container image
    • Install without uv
    • Sandbox a team devcontainer
    • Roll out the sandbox across an organisation
    • Upgrade claude-sandbox
  • Access and isolation
    • Authenticate with forges
    • Make extra paths writable
    • Pass environment variables in
    • Configure the network egress jail
    • Verify the sandbox
  • Agents and skills
    • Use Pi with OpenAI or Anthropic
    • Run Pi against a local model
    • Share skills between agents
  • Testing and development
    • Test a web app with browser automation
    • Automate VS Code
    • Contribute to claude-sandbox

Reference

Dry, factual lookup: config keys, paths, checks, and flags.

• Reference
  • Configuration
  • Deliberately exposed and out of scope
  • Locked-down defences
  • Verification checks
  • What’s installed

Explanations

The why behind the design: threat model, sandbox rationale, and the network egress jail.

• Explanations
  • Architecture
  • Architectural Decision Records
  • Launch isolation and updates
  • Sandbox internals: design rationale
  • Threat model

Using Claude Code at Diamond Light Source

DLS developers: start at Claude Code at DLS — the one-page policy summary and getting-started instructions.