DEV Community

Cover image for Your AI agent's dev container is not a sandbox (docker.sock, --privileged, ~/.ssh)
TANK JAY
TANK JAY

Posted on Originally published at jaytank.hashnode.dev

Your AI agent's dev container is not a sandbox (docker.sock, --privileged, ~/.ssh)

#docker #devcontainers #security #vscode

"Run the agent in a dev container" is the standard answer for letting Claude Code, Codex or Aider run commands on their own. It only works if the container stays a box. This made-up devcontainer.json does not:

"privileged": true,
"runArgs": ["--network=host", "--security-opt", "seccomp=unconfined"],
"mounts": [
  "source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind",
  "source=${localEnv:HOME}/.ssh,target=/home/node/.ssh,type=bind"
],
"remoteUser": "root"
Enter fullscreen mode Exit fullscreen mode

What each line gives away

  • privileged: per the docker run docs, all capabilities on, seccomp and AppArmor off, all host devices. "Not a securely sandboxed process."
  • docker.sock: the host's Docker API. Docker says only trusted users should control the daemon; with it you can start a container with the host's / mounted.
  • --network=host: the container's network stack "isn't isolated from the Docker host". Every localhost service is in reach, and an in-container firewall edits the host's rules.
  • seccomp=unconfined: no syscall filter. It is the securityOpt example in the devcontainer.json reference, which is why it gets copied.
  • ~/.ssh, ~/.aws mounts: no escape needed. The Claude Code dev container docs say to avoid mounting host secrets and to prefer repository-scoped or short-lived tokens.

A prompt injection in one README the agent reads is enough to use any of these.

Checked in VS Code

I built BoxEscape, a free VS Code extension that checks devcontainer.json, Docker Compose files and docker run lines in agent scripts. It detects when a container runs an AI agent (here from postCreateCommand installs @anthropic-ai/claude-code) and gets stricter about sockets and credentials. Real output on the file above:

BE001 error    privileged: true runs the "shop-api" container privileged
BE003 warning  runArgs --network: host network shared with the "shop-api" container
BE005 error    runArgs --security-opt: seccomp=unconfined in the "shop-api" container
BE002 error    mounts: /var/run/docker.sock into the "shop-api" container
BE006 error    mounts: ~/.ssh into the "shop-api" container
BE011 warning  remoteUser: root for the agent in the "shop-api" container
Enter fullscreen mode Exit fullscreen mode

Eleven rules, including an egress firewall script that is missing, never run or has its failure swallowed with || true. Quick Fixes remove the setting or make a mount read-only, and an activity bar panel lists every finding. Fully offline.

code --install-extension jaytankdev.boxescape
Enter fullscreen mode Exit fullscreen mode

Source (MIT): github.com/jay-tank/boxescape

Full write-up (the doc quotes for every setting, safer replacements, all eleven rules, FAQ): Your AI coding agent's dev container is not a sandbox

Top comments (0)