trailofbits/claude-code-devcontainer

Sandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.

What it solves

This project provides a secure, containerized environment for running Claude Code with the bypassPermissions flag enabled. This flag allows the AI to execute commands without manual confirmation, which is risky on a host machine. The devcontainer isolates the AI's filesystem access to the project directory and a disposable container, preventing it from accessing the rest of the host system.

How it works

It uses Docker-based devcontainers to create a filesystem-isolated sandbox. The project includes a CLI helper (devc) to manage the container lifecycle, including starting, rebuilding, and destroying containers. It supports two main workflows: isolated per-project containers or shared workspace containers for multiple related repositories. To handle Claude Code's interactive login requirements in containers, it implements a token-based authentication forwarding system.

Who it’s for

  • Security auditors reviewing client code without exposing their host machines.
  • Developers exploring untrusted or unknown repositories safely.
  • Developers performing experimental work where they want Claude to modify code freely.
  • Professionals managing multiple related repositories for a single engagement.

Highlights

  • Filesystem Isolation: Prevents unrestricted AI command execution from affecting the host.
  • devc CLI: A dedicated tool for instance management, including session syncing and custom bind mounts.
  • Session Syncing: Copies session logs from containers to the host so that Claude's /insights command can analyze them.
  • Network Isolation: Optional iptables and ipset configurations to restrict outbound network access to specific allowlists.
  • Pre-configured Environment: Ships with Ubuntu 24.04, Node.js 24, Python 3.13, and a suite of development tools like rg, fd, and tmux.

Related

  • Project
    go-skynet/go-llama.cpp

    Go bindings for llama.cpp that enable high-performance local LLM inference within Go applications using the GGUF format.

  • Project
    atomistic-machine-learning/schnetpack

    A deep learning toolbox for predicting quantum-chemical properties of molecules and materials using atomistic neural networks.

  • Project
    SandAI-org/MagiAttention

    A distributed attention mechanism designed for ultra-long context and heterogeneous mask training, offering linear scalability and high performance on H100 and B200 GPUs.

  • Project
    tastyeffectco/sandboxd

    An open-source, self-hosted AI app builder engine that uses coding agents to create and host real applications in isolated Docker sandboxes on your own server.