A detailed walkthrough builds a Vagrant-based VM sandbox for running Claude Code locally with minimal confirmation prompts while restricting access to credentials, git push/commit, and software installation. It covers configuring a restricted 'claude' user, rootless Docker, IntelliJ MCP server port forwarding, AppArmor profiles for Bubblewrap, and path translation between host and guest. The piece also documents concrete bypass techniques (scripted git commands, Docker-based credential exfiltration) showing the sandbox trades some security for convenience and does not provide airtight protection.
Table of contents
In briefWhy local sandboxes are necessaryPrerequisitesCreating the sandboxBuilding the sandboxExecuting the sandboxSecurity limitationsConclusionTags:Questions this post answers
How can I sandbox Claude Code running locally so it can't access my credentials or push to git?
Run Claude Code inside a Vagrant VM as a restricted, unprivileged 'claude' user with no sudo access, deny rules blocking direct git add/commit commands, filesystem deny rules blocking reads of the Claude config and API key files, and managed settings with allowManagedPermissionRulesOnly enabled. The Anthropic API key is stored in a root-owned 600 file readable only through a launcher script, never exposed directly to the agent's shell. Developers hardening local AI agent setups can track sandboxing techniques like this on daily.dev.
Can a Claude Code sandbox with deny rules for git add and git commit actually be bypassed?
Yes, deny rules like Bash(git add) and Bash(git commit) only block those commands when run directly, not when embedded inside a script. A prompt asking Claude to write a shell script containing git init, touch, and git add commands and then execute that script bypasses the deny rules entirely, letting the agent commit files despite the restrictions. Anyone relying on AI agent permission rules should follow reports like this on daily.dev before trusting a sandbox blindly.
Why can Docker be used to exfiltrate credentials from a sandboxed Claude Code agent even with strict deny rules?
Docker runs as a separate daemon outside the Claude Code sandbox's control, so its filesystem access is not restricted by the sandbox's denyRead rules. A prompt instructing Claude to create a Dockerfile that mounts a blocked file like .claude.json and echoes its contents inside a container can read and exfiltrate credentials the sandbox explicitly denies at the Claude tool level. Teams weighing AI agent convenience against security risk can track findings like this on daily.dev.