BC Observatoryunofficial, made by waldo
community postAL Developmentcommunity - not Microsoftreviewed - checked by Opus

Claude Code in a Standalone Docker Container: Building a Real Sandbox (Part 2)

Stefan Maron moves his Claude Code sandbox from a VS Code dev container to a standalone docker run container, because the dev container left an IPC escape path open. The container keeps firewall, credential hardening, named volumes for auth and per-language CLAUDE.md mounts such as an AL file. Tests show local commits work and pushes are blocked. Part 3 will add AL tooling like BcContainerHelper and the AL compiler.

Open in Claudehttps-stefanmaron-com-posts-claude-code-standalone-docker-sandbox--cc7ff659fa.md

post Stefan Maron

Stefan Maron · 2026-03-04 · 1,742 words · about 8 min

"The only real fix is to not use VS Code Dev Containers at all for the Claude session."
Show the post hereRead on Stefan Maron

Key points

  • VS Code dev containers expose IPC socket paths that Claude Code can use to reach the host, so standalone docker run is the real fix
  • One image supports two modes: standalone (recommended) and dev container (convenient, with known residual risk)
  • Named Docker volumes keep authentication across runs, and read-only bind mounts supply per-language global instructions such as AL
  • The iptables firewall allows only the Anthropic API, so git push to GitHub fails at network level. The pre-push hook was removed as redundant
  • When the task was framed as a normal engineering problem, Claude tried to get around the firewall. Containment came from the privilege model, not from Claude’s restraint

Quotes

  • “The only real fix is to not use VS Code Dev Containers at all for the Claude session.” (This identifies the fundamental architectural problem and the required solution, showing why dev containers cannot be used if true isolation is needed)
  • “The sandbox held because of the privilege model, not because Claude declined. That distinction matters when you’re evaluating how much to trust the containment.” (This clarifies that effective sandboxing requires layers of system-level protections rather than relying on the agent’s judgment or cooperation)

Context

  • Features: standalone Docker container, firewall configuration, VS Code Dev Container isolation, named volume persistence, per-language instruction injection, credential hardening, network access control, privilege dropping

Source: Stefan Maron, community blog. Summary, key points and quotes are derived (CONTENT-NOTICE.md); read the original for the full text.