Thanks.

I love that you love it. That's why I do it. :-)

My co-worker figured out a way to run the GitHub CLI with read-only keys restricted to specific repos. I need to do that still.

I don't want to isolate the container from the Internet :-) I understand that this is not the safest possible way (exfiltrating is still possible, but I mostly work on open source anyway, so that's not an issue), but I think the convenience wins here.

That said, if you have suggestions that are not super inconvenient, please let me know.

My main goal with this was to make sure it cannot go wild on my own system.

I love how everyone is trying to solve the same problems, and how different the solutions are.

I made this little Dockerfile and script that lets me run Claude in a Docker container. It only has access to the workspace that I'm in, as well as the GitHub and JIRA CLI tool. It can do whatever it wants in the workspace (it's in git and backed up), so I can run it with --dangerously-skip-permissions. It works well for me. I bet there are better ways, and I bet it's not as safe as it could be. I'd love to learn about other ways that people do this.

https://github.com/binwiederhier/sandclaude