Claude Code sandbox: devcontainer isolation, egress filtering, and zero exposed secrets
Hansehart · reddit · 2026-09-05
A developer who lets Claude write nearly all his production code shares his security-first devcontainer setup: run Claude Code in a standardized devcontainer (noting Docker shares the host kernel; VMs or Docker sbx are safer), keep secrets entirely outside the agent's reach, and apply an egress filter so container processes can only hit explicitly whitelisted hosts. For productivity he stacks multiple projects and worktrees, static typing/lints/TDD/e2e tests, open-source-only dependencies, a VSCode workspace, and Docker-in-Docker (DinD) so broken builds surface before any push or deploy. He also advises not burning tokens one by one and building a way to measure progress. Next steps: minikube and better UX; requires familiarity with VSCode and devcontainers.
More from coding & agent
- 105 Real Bugs Tested: GPT-6.1 Sol Over 10x Cheaper Than GPT-5.6 Sol — PawelHuryn · 2026-10-23
- Dev builds SkiFree-style sled game in one prompt, praises DeepSeek Flash — victormustar · 2026-10-23
- Every ditched personal agents for a shared Claude Managed Agents coworker in one week — every · 2026-10-23
- WorkOS shows how to let AI agents safely sign up for your app with auth.md and ID-JAG — AI Engineer · 2026-10-23
- Devs on Reddit swap tactics for stopping prompt regressions in AI agents — SleepFlimsy6963 · 2026-10-23
- Claude Code + ComfyUI MCP workflow for client work: paid models or open weights? — newaccount47 · 2026-10-23