add image

2026-09-20 05:48:43 +05:00
parent 5c3cb56a45
commit a1135d553b
2 changed files with 24 additions and 0 deletions
@@ -1,10 +1,34 @@
+# ccc

+![ccc](basahaa-claude.jpg)

+Claude Code in a container.
+
+## Why
+
+So that I am forced to not be lazy and let agent do literally everything for me, for example installing a package, I will need claude to ask me to install.
+
+Claude Code normally runs directly on your machine, which means it can read anything your user can read — SSH keys, browser profiles, other repos, `~/.aws`, your whole home directory. Permission prompts help, but they are a guardrail rather than a boundary: once you approve a command, it runs with your full user privileges.
+
+This image puts Claude Code in a Docker container so that boundary is enforced by the kernel instead of by the agent's good behaviour:
+
+- **Only the project is visible.** The container sees `$PWD` and nothing else of your filesystem. Everything outside the directory you launched it from simply does not exist as far as Claude is concerned.
+- **Credentials stay out of reach.** No `~/.ssh`, no `~/.aws`, no `.env` files from unrelated projects, no shell history. The only things mounted are `~/.claude` and `~/.claude.json`, which Claude Code needs for auth and session state.
+- **The system is disposable.** Installing packages, running build scripts, or letting an agent `rm -rf` its way through a mistake affects a container that goes away on exit (`--rm`), not your host.
+
+The trade-off is deliberate: commands that need host access (your global git config, a system package manager, a service running on the host) will not work unless you mount or expose them yourself. Ask claude to ask you for assistance.
+
+This also prevents any sort of hacking via AGENT.md (for example someone esle repo AGENT.md asked llm to send my private ssh keys to them) 

 ## How to use
+1. Add alias (Optional)
 ```bash
 alias claude='docker run --rm -it -v ~/.claude:/root/.claude -v ~/.claude.json:/root/.claude.json -v $PWD:$PWD -w $PWD git.shihaam.dev/dockerfiles/ccc'
 ```
+2. Just run same as when claude was system
+```bash
+claude
+```

 Args pass straight through: