Claude Code in a Standalone Docker Container: Building a Real Sandbox (Part 2)
The presenter builds a standalone Docker run sandbox for Claude Code (bypass permissions mode). The earlier dev container approach failed because Claude Code could rebuild the VS Code IPC bridge and escape. The video covers named volumes for login, mountable global instruction files (for example AL or Python), a firewall that only allows Anthropic traffic so git pushes must happen outside the container, a container security scan, and plans to add AL development tooling next.
- Context and Problem Statement
- Previous Attempts and Approach Decision
- Setup and Planning with Claude
- Standalone Docker Implementation Strategy
- Volume Mounting and Security Considerations
- Context Clearing and Named Volumes Setup
- Mounting Custom Instruction Files into Container
- Building and Testing Docker Container
- Installation Issues and Authentication Setup
- Authentication Persistence Challenges
- Security Escape Testing and Container Assessment
- Git Operations and Credential Passing
- Resume Session and Firewall Security
- Pre-push Hook Removal and Testing Strategy
- Community Penetration Testing and Linux Development
- Firewall Rules and Security Hardening
- Iterative Problem-solving and Closing Remarks
Overview
Part 2 of a live session on trapping Claude Code in a container. In the dev container setup, Claude Code could rebuild the bridge between VS Code and the container and get out, even after several fixes. The presenter moves to a standalone Docker run mode, which he says removes that attack surface, and considers keeping a hybrid mode so users can choose convenience or safety.
He works through installation problems, authentication that does not persist, git credential handling and a firewall that allows only Anthropic and VS Code domains. He tests an escape attempt and a container security scan, then removes the pre-push hook so pushes happen from outside the container. He invites viewers to try to break the sandbox and file GitHub issues. AL tooling is planned for a later stream.
Key points
- In the dev container setup, Claude Code could reconstruct the VS Code to container bridge and escape, even after several fix attempts. Standalone Docker run is presented as removing that attack surface.
- Installation failed because the config data volume shadowed the Claude installation. The fix is to install Claude to a different location or adjust the volume mapping.
- Named volumes in the run command are meant to carry the Claude Code login so it does not repeat on every new container. During testing, authentication again did not persist at first, the same issue seen earlier with dev containers.
- A separate markdown instruction file can be mounted from the host as the global instruction file, so different sets (for example Python or AL) can be used without copying them into each project.
- A firewall script blocks outbound traffic except to Anthropic and VS Code domains, so git pushes from inside the container fail. Commits inside the container still work. The pre-push hook was removed so pushes can be done from outside the container.
- Claude Code refused to run a full red team test against the host. A security scan took 1 minute 16 seconds and reported a four-layer defense in depth. It noted possible weaknesses around storage driver extended attributes and DNS.
- Lesson learned: Claude Code will not directly escape, but if the issue is framed as a problem to solve it tries hard to help, for example by working around the firewall script.
Features
| Feature | Status | At |
|---|---|---|
| Claude Code Standalone Docker Container Approach | status not stated | 3:18 |
| VS Code IPC Escape Vulnerability | status not stated | 1:35 |
| Hybrid Dev Container and Standalone Approach | status not stated | 3:44 |
| Docker Volume Mount for Project Folders | status not stated | 10:32 |
| Claude Code Plan Mode Auto-activation | status not stated, demoed | 6:03 |
| Git Credential Protection via Pre-push Hook | status not stated | 14:01 |
| Git credential stripping in Docker | status not stated | 14:12 |
| Named volumes for Cloud Code credentials | status not stated, demoed | 17:24 |
| Mountable custom instruction files | status not stated, demoed | 18:19 |
| Context clearing after planning | status not stated | 15:26 |
| Docker Container Volume Shadowing Fix | status not stated, demoed | 27:51 |
| Authentication Persistence in Containers | status not stated, demoed | 29:21 |
| Container Escape Prevention | status not stated, demoed | 35:06 |
| Container Security Assessment Report | status not stated, demoed | 38:00 |
| Docker container with firewall and pre-push hook | status not stated, demoed | 41:55 |
| Claude Code agent inside container | status not stated, demoed | 40:25 |
| Storage driver extended attribute support issue | status not stated | 39:16 |
| Git config passing from host to container | status not stated | 43:28 |
| Pre-push hook removal | status not stated, demoed | 52:01 |
| Firewall-based git blocking | status not stated, demoed | 58:23 |
| Container escape testing framework | status not stated | 53:00 |
| Cloud Code session resume functionality | status not stated, demoed | 57:24 |
| AL tooling integration for container | status not stated | 57:38 |
| Sudo hardening and firewall re-enablement | status not stated, demoed | 1:00:50 |
| Claude Code container security model | status not stated | 1:05:36 |
AL objects mentioned
As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.
- other “cloud sandbox alias” at 10:57
- other “Dockerfile” at 16:20
- other “VS Code” at 40:12
- other “GitHub” at 41:55
- other “IP tables” at 47:51
Quotes
- 0:25 “we are trying to trap cloud code in a container and uh the reason for this or the reasons for this might be different.”
- 2:03 “if that’s in place, it’s really hard to really have a clean way of trapping the uh the the cloud code inside the container”
- 2:15 “because it can uh even reverse engineer um that bridge basically from with inside the container.”
- 2:45 “cloud code was still able to reconstruct this bridge. So um that’s that’s something we want to work with today.”
- 3:44 “should we keep the hybrid uh way of running it so people can decide whether they want to risk it or go safe.”
Disclaimers in the video
- 3:18 subject-to-change: we cannot fully mitigate those uh vulnerabilities. Standalone Docker run modes eliminates the tech surface entirely
- 6:48 preview: there is a a voice command rolling out, but I don’t seem to get any of the the preview things
- 53:00 other: Try to break it. If you manage to break it, ask your agent to create an issue on my GitHub and I will then try to fix it.
- 53:43 other: if nobody will be able to find anything any back door to escape that container then I will continue the next stream to start to bake in my tuning.
- 53:43 coming-later: I will continue the the next stream to start to bake in my tuning
- 57:58 coming-later: next time I will either, uh, go through issues that manage to breach out of this container or if if there are none
Presenters (as heard): Dennis, Claude Code.