Running Claude Code in a Sandboxed Docker Container
If you've ever wanted to run Claude Code with full permissions, without worrying about it touching anything outside your project, this one-liner install script does exactly that.
What it does
The script builds a minimal Docker image (node:22-slim) with Claude Code and the rtk CLI pre-installed, then wires up two shell aliases:
-
claude-docker, launches Claude Code inside the container with--dangerously-skip-permissions, your current directory mounted at/workspace -
claude-docker-sh, drops you into a bash shell in the same container, useful for poking around or debugging
Out of the box, Claude Code asks for your approval before it touches anything, fine for supervised work, but it gets in the way if you want the agent to run unattended. The way around that is the --dangerously-skip-permissions flag, and the name is not for show: it lets the agent read, modify, or delete anything your user account can reach, with no confirmation step in between. Running that on your host is a real risk, since a bad edit or an errant command could take out project files, dotfiles, or anything else in reach. Containerizing sidesteps the problem rather than mitigating it, Claude still runs with full, unattended permissions, but its reach is limited to the container's filesystem plus whatever you've explicitly mounted, so whatever happens stays scoped there instead of spilling out onto the rest of your machine.
Install
Docker needs to be installed and running first, the script builds an image and everything else depends on that.
Two versions are available depending on your shell:
bash:
curl -s https://gist.githubusercontent.com/acashjos/93f47fce263dcaaa1cd5ba38b4459ffb/raw/5944ef120f150ca08287d406ff3397a6687b871f/claude-docker-install-bash.sh | sh
zsh:
curl -s https://gist.githubusercontent.com/acashjos/93f47fce263dcaaa1cd5ba38b4459ffb/raw/5944ef120f150ca08287d406ff3397a6687b871f/claude-docker-install-zsh.sh | sh
Or download it first, review it, then run:
curl -O https://gist.githubusercontent.com/acashjos/93f47fce263dcaaa1cd5ba38b4459ffb/raw/5944ef120f150ca08287d406ff3397a6687b871f/claude-docker-install-bash.sh
chmod +x claude-docker-install-bash.sh
./claude-docker-install-bash.sh
The script builds the image, appends the aliases to your .bashrc (or .zshrc), and sources the file so they're available immediately.
Usage
From any project directory:
claude-docker
This mounts your current working directory into the container and starts Claude Code with all permissions granted. On first run, use the /login command inside Claude Code to complete authentication.
Need a plain shell in the same environment instead?
claude-docker-sh
Under the hood, the install script just appends two docker run one-liners to your shell rc file as aliases, no separate binary, no PATH changes, just plain shell aliasing. That's what makes claude-docker and claude-docker-sh available as regular commands once the file is sourced.
The image itself starts from node:22-slim and installs git, curl, and gh via apt, then @anthropic-ai/claude-code via npm, plus the rtk CLI through its own install script. It also creates a dedicated non-root claudeuser to run as, rather than executing everything as root inside the container.
Full source and both shell variants: gist.github.com/acashjos/93f47fce263dcaaa1cd5ba38b4459ffb
Top comments (2)
What's the benefit of containerizing a Claude code instance in this way?
Claude code by default runs with zero permissions. When you want to run it unattended, you should run it with a
--dangerously-skip-permissionsflag. By the name suggests, it is not safe to run it on your host machine. The agent could modify or destroy your files or the system itself without asking for consent.By containerizing the agent runs in a docker container with access only to the current working directory.
[Edited the content to include this explanation]