---
title: "Sandboxing local AI Agents"
url: https://daily.dev/posts/sandboxing-local-ai-agents-jja6mrthe
source_url: https://octopus.com/blog/local-ai-agent-sandboxes
type: article
source: "OctopusDeploy"
published: 2026-08-17T11:20:20.404Z
updated: 2026-08-17T11:20:47.499Z
tags: ["devops", "ai-agents", "docker", "claude-code"]
reading_time: 25
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandboxing local AI Agents

**[OctopusDeploy](https://daily.dev/sources/octopusdeploy)** · 25 min read · 0 upvotes · 0 comments

## Summary

A detailed walkthrough builds a Vagrant-based VM sandbox for running Claude Code locally with minimal confirmation prompts while restricting access to credentials, git push/commit, and software installation. It covers configuring a restricted 'claude' user, rootless Docker, IntelliJ MCP server port forwarding, AppArmor profiles for Bubblewrap, and path translation between host and guest. The piece also documents concrete bypass techniques (scripted git commands, Docker-based credential exfiltration) showing the sandbox trades some security for convenience and does not provide airtight protection.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://octopus.com/blog/local-ai-agent-sandboxes>

## Questions this post answers

### How can I sandbox Claude Code running locally so it can't access my credentials or push to git?

Run Claude Code inside a Vagrant VM as a restricted, unprivileged 'claude' user with no sudo access, deny rules blocking direct git add/commit commands, filesystem deny rules blocking reads of the Claude config and API key files, and managed settings with allowManagedPermissionRulesOnly enabled. The Anthropic API key is stored in a root-owned 600 file readable only through a launcher script, never exposed directly to the agent's shell.

_Developers hardening local AI agent setups can track sandboxing techniques like this on daily.dev._

### Can a Claude Code sandbox with deny rules for git add and git commit actually be bypassed?

Yes, deny rules like Bash(git add) and Bash(git commit) only block those commands when run directly, not when embedded inside a script. A prompt asking Claude to write a shell script containing git init, touch, and git add commands and then execute that script bypasses the deny rules entirely, letting the agent commit files despite the restrictions.

_Anyone relying on AI agent permission rules should follow reports like this on daily.dev before trusting a sandbox blindly._

### Why can Docker be used to exfiltrate credentials from a sandboxed Claude Code agent even with strict deny rules?

Docker runs as a separate daemon outside the Claude Code sandbox's control, so its filesystem access is not restricted by the sandbox's denyRead rules. A prompt instructing Claude to create a Dockerfile that mounts a blocked file like .claude.json and echoes its contents inside a container can read and exfiltrate credentials the sandbox explicitly denies at the Claude tool level.

_Teams weighing AI agent convenience against security risk can track findings like this on daily.dev._

## Similar posts on daily.dev

- [I gave Claude Code its own disposable computer, and stopped caring what it installed](https://daily.dev/posts/i-gave-claude-code-its-own-disposable-computer-and-stopped-caring-what-it-installed-iqddqhras) · XDA Developers · 1 upvotes · 1 comments
- [Docker Sandboxes: Run Claude Code and More Safely](https://daily.dev/posts/docker-sandboxes-run-claude-code-and-more-safely-6ydoupfk7) · Docker · 1 upvotes · 0 comments
- [A better way to limit Claude Code \(and other coding agents\!\) access to Secrets – blog](https://daily.dev/posts/a-better-way-to-limit-claude-code-and-other-coding-agents-access-to-secrets-blog-yu0vomcjx) · Hacker News · 1 upvotes · 0 comments

---

Tags: [#devops](https://daily.dev/tags/devops), [#ai-agents](https://daily.dev/tags/ai-agents), [#docker](https://daily.dev/tags/docker), [#claude-code](https://daily.dev/tags/claude-code)

[View this post on daily.dev](https://daily.dev/posts/sandboxing-local-ai-agents-jja6mrthe)