Claude Code sandbox: devcontainer isolation, egress filtering, and zero exposed secrets
Hansehart · reddit · 2026-09-05
A developer who lets Claude write nearly all his production code shares his security-first devcontainer setup: run Claude Code in a standardized devcontainer (noting Docker shares the host kernel; VMs or Docker sbx are safer), keep secrets entirely outside the agent's reach, and apply an egress filter so container processes can only hit explicitly whitelisted hosts. For productivity he stacks multiple projects and worktrees, static typing/lints/TDD/e2e tests, open-source-only dependencies, a VSCode workspace, and Docker-in-Docker (DinD) so broken builds surface before any push or deploy. He also advises not burning tokens one by one and building a way to measure progress. Next steps: minikube and better UX; requires familiarity with VSCode and devcontainers.
More from coding & agent
- Cognition rumored to launch a new model soon, per AI insider hunch — realsohamparekh · 2026-09-06
- Redditor builds free AskSary creative studio with game engine GPT can play and patch live — Beneficial-Cow-7408 · 2026-09-06
- Do the fun terminal work yourself, let Claude handle the boring chores — 4310sy · 2026-09-06
- Heavy AI user's cost ledger: 100+ agents a day, $70 of DeepSeek in two days — simmon_charlie · 2026-09-06
- First untrained agent run on local Qwen 3.8 Flash, no skills configured — jasonkneen · 2026-09-06
- Is a schema-aware memory graph 'overfitting'? Dev asks for the cleanest leakage test — chaachans · 2026-09-06