Why should I run Claude Code inside a Docker container instead of my host terminal?

When you run an AI coding agent directly on your macOS or Linux host, it inherits full read access to your ~/.ssh keys, ~/.aws credentials, browser cookies, and unrelated repositories. Inside a scoped Docker container, the agent can only see the single project directory you explicitly bind-mount.

Is it safe to use --dangerously-skip-permissions inside a Docker sandbox?

Running autonomous flags like --dangerously-skip-permissions inside an isolated container with no mounted host secrets and restricted network egress is drastically safer than running it on bare metal. However, you should still pass only non-production test API keys and commit clean Git checkpoints before starting an unattended loop.

How do I pass my Anthropic or OpenAI API key into the Docker container securely?

Pass the API key as a runtime environment variable using the -e flag (e.g., -e ANTHROPIC_API_KEY) or inject it dynamically via 1Password CLI (op run) rather than baking keys into the Dockerfile or image layers.

The 5-Minute Guide: How to Run Claude Code & Cursor Inside a Disposable Docker Sandbox

November 12, 2026

📅 Published: November 2026 | ✍️ By MyTechDiary Editorial Team | ⏱️ 8 min read | 🏷️ Category: Docker, DevSecOps & AI Agents

By the 20th confirmation popup of the hour, nobody reads the prompt anymore—your brain goes on autopilot and clicks "Yes, don't ask again" just to ship code.

In our previous security breakdown, we saw how this exact approval fatigue caused thousands of live AWS, Supabase, and database credentials to leak via .claude/settings.local.json.

The real cure isn't superhuman willpower. It's architectural isolation. If your AI agent lives inside a disposable Docker sandbox, your host ~/.ssh, ~/.aws, and personal files simply do not exist to it. You can let Claude Code, OpenAI Codex, or Cursor Agent run at full speed—and destroy the entire container the second the task finishes.

Here is the exact 5-minute copy-paste setup for both CLI purists (Docker one-liner) and IDE users (VS Code / Cursor Devcontainers).

Disclosure: MyTechDiary benchmarks developer workflows independently. Some links in this guide are affiliate recommendations (such as Cloud VPS sandboxes and 1Password Developer CLI), supporting our engineering lab at no extra cost to you.

1. Option A: The 30-Second Disposable CLI Sandbox (Claude Code / Codex)

You don't need Kubernetes or complex VM hypervisors. You can lock Claude Code inside an ephemeral Node.js container that mounts only your current working repository and deletes itself automatically on exit (--rm).

Step 1: Create a Reusable `Dockerfile.agent`

Save this minimal, hardened Dockerfile anywhere in your home directory (e.g., ~/docker-agent/Dockerfile):

FROM node:22-bookworm-slim

# Install essential CLI tools (git, ripgrep, curl, python3)
RUN apt-get update && apt-get install -y --no-install-recommends \
    git ripgrep curl ca-certificates python3 python3-pip \
    && rm -rf /var/lib/apt/lists/*

# Install Claude Code CLI globally
RUN npm install -g @anthropic-ai/claude-code

# Run as non-root user for extra container safety
USER node
WORKDIR /workspace

Step 2: Build Once & Add a Shell Alias

Build the image once, then add a clean ai-sandbox alias to your ~/.zshrc or ~/.bashrc:

# 1. Build the reusable sandbox image
docker build -t claude-sandbox ~/docker-agent

# 2. Add this function to ~/.zshrc or ~/.bashrc
ai-sandbox() {
  docker run --rm -it \
    --name "agent-$(basename $(pwd))" \
    -v "$(pwd):/workspace" \
    -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" \
    --cap-drop=ALL \
    --security-opt=no-new-privileges \
    claude-sandbox claude
}

🛡️ Why Those Security Flags Matter:

--rm: Destroys the container filesystem the instant you exit—no lingering temp caches or stray background daemons.
-v "$(pwd):/workspace": The agent can only read/write inside your current repo. Your ~/.ssh, ~/.aws, and browser profiles do not exist.
--cap-drop=ALL & --security-opt=no-new-privileges: Strips Linux kernel capabilities so even a rogue script cannot escalate privileges.

🔐 Secret Injection Pro Tip

Stop Exporting Raw API Keys in Plaintext `.zshrc` Files

Instead of leaving ANTHROPIC_API_KEY in plain shell history, wrap your sandbox command with 1Password CLI (op run -- ai-sandbox) or spin up an isolated remote Linux Cloud VPS via DigitalOcean so nothing ever touches your primary laptop.

Get 1Password Developer CLI → Claim $200 Cloud VPS Credit →

2. Option B: Zero-Friction VS Code & Cursor `devcontainer.json`

Prefer visual diffs inside Cursor or VS Code? Create a .devcontainer/devcontainer.json file inside your project. When you click "Reopen in Container", your entire editor UI connects seamlessly to the isolated sandbox while keeping host files completely off-limits.

{
  "name": "AI Agent Sandbox",
  "image": "mcr.microsoft.com/devcontainers/javascript-node:22",
  "remoteUser": "node",
  "runArgs": [
    "--cap-drop=ALL",
    "--security-opt=no-new-privileges"
  ],
  "postCreateCommand": "npm install -g @anthropic-ai/claude-code",
  "customizations": {
    "vscode": {
      "extensions": [
        "dbaeumer.vscode-eslint",
        "esbenp.prettier-vscode"
      ]
    }
  }
}

3. Bare-Metal Host vs Docker Sandbox: Risk Breakdown

Threat Vector	Standard Host Terminal	Disposable Docker Sandbox
Accidental `rm -rf`	❌ Can wipe home folder & other repos	✅ Contained to mounted repo (recoverable via Git)
`~/.ssh` & `~/.aws` Exposure	❌ Fully readable by any agent script	✅ Completely invisible inside container
Prompt Approval Fatigue	❌ High risk when clicking "Don't ask again"	✅ Safe to grant broad autonomy in workspace

Ship Faster Without Risking Your Workstation

Combine disposable Docker containers with pre-commit secret scanning and remote Cloud VPS runners for total peace of mind.

Deploy Cloud Sandbox VPS ($200 Credit) Try 1Password Developer CLI

MyTechDiary