dockerfiles/ccc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

claude is now aware that its in a container

Browse Source
This commit is contained in:
shihaam
2026-09-21 08:12:18 +05:00
parent 956cbc708a
commit a7a77f7b17
4 changed files with 90 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16 -1
View File
@@ -16,7 +16,22 @@ This image puts Claude Code in a Docker container so that boundary is enforced b
- **Credentials stay out of reach.** No `~/.ssh`, no `~/.aws`, no `.env` files from unrelated projects, no shell history. The only things mounted are `~/.claude` and `~/.claude.json`, which Claude Code needs for auth and session state.
- **The system is disposable.** Installing packages, running build scripts, or letting an agent `rm -rf` its way through a mistake affects a container that goes away on exit (`--rm`), not your host.
The trade-off is deliberate: commands that need host access (your global git config, a system package manager, a service running on the host) will not work unless you mount or expose them yourself. Ask claude to ask you for assistance.
The trade-off is deliberate: commands that need host access (your global git config, a system package manager, a service running on the host) will not work unless you mount or expose them yourself.
## Claude knows it is boxed in
The image ships a system prompt (`sandbox-prompt.md`, appended by the entrypoint) that tells Claude it is in a container: the host filesystem, your shell environment, your SSH keys, your host services and your host toolchain are not there.
So instead of flailing or pretending it worked, Claude stops and hands you the exact command to run in your own terminal, then waits for you to paste the output back:
> I can't reach your host Docker daemon from in here. Run this and paste the output:
> ```bash
> docker compose logs --tail=50 api
> ```
It also asks for specific environment variables by name rather than a whole `env` dump, and tells you to redact secrets before pasting. Note that typing `! command` inside the session runs it *in the container*, not on your host.
Edit `sandbox-prompt.md` and rebuild if you want to change what it asks for.
This also prevents any sort of hacking via AGENT.md (for example someone esle repo AGENT.md asked llm to send my private ssh keys to them)