gw000/docker-claude-code repository overview

⁠docker-claude-code - Dockerized Claude Code Sandbox

Run Claude Code in an isolated Docker container with multi-profile support, security hardening, best-practice defaults, a set of pre-installed plugin/skill bundles and remote dev support. Drop-in replacement for claude — a simple shell alias is all it takes.

• Drop-in replacement: Works like claude — same arguments after --, same workflow, just run cc1 instead of claude, Linux and MacOS support.
• Secure sandbox: Non-root user and no sudo, all capabilities dropped, hardened seccomp policy, supports gVisor syscall isolation, additional nested bubblewrap for sandboxed Bash tool, startup security scans (AgentShield + unicode), audit log at ~/.claude/audit-log.jsonl.
• Multi-profile support: Per-profile persistent state in ~/.claude-<profile> to separate work and personal accounts, mix subscription and API key billing.
• Best practices by default: Start in plan mode, optimized token usage, telemetry disabled, claude-powerline status line, pre-configured tool allowlist and denylist.
• Plugins and skills: SuperClaude, claude-skills, codemap, 58+ agentic-awesome-skills bundles, and Anthropic's official marketplace, enabled on demand via /plugin.
• Remote dev support: Mutagen bidirectional sync + Docker socket forwarding allow executing commands in a remote dev environment.
• Minimal and auditable: ~200 lines of shell + Dockerfile, no dependencies beyond Docker, small enough to read and modify — don't trust us, ask your AI to audit it.

Change: With 0.9.0 the advanced syntax changed to support multiple mount dirs, all claude arguments must now follow a liteal -- (e.g. cc1 -- -p "prompt"). We also shortened the DISABLE_SECURITY_SCAN env var to DISABLE_SCAN. Do not forget to update the shell alias script to take effect.

⁠Build

docker build -t docker-claude-code .
# or pull latest:
docker pull ghcr.io/gw0/docker-claude-code:main
docker pull gw000/docker-claude-code:main

⁠Install

Download the shell alias script and hardened seccomp, customize profile names (CLAUDE_PROFILES), and source it in your shell:

mkdir -p ~/.config/docker-claude-code
curl -fsSLo ~/.config/docker-claude-code/claude-aliases.bashrc https://raw.githubusercontent.com/gw0/docker-claude-code/main/claude-aliases.bashrc
curl -fsSLo ~/.config/docker-claude-code/claude-seccomp.json https://raw.githubusercontent.com/gw0/docker-claude-code/main/claude-seccomp.json

# Linux (bash):
echo 'export CLAUDE_PROFILES="cc1 ccpersonal ccapi"' >> ~/.bashrc
echo 'source ~/.config/docker-claude-code/claude-aliases.bashrc' >> ~/.bashrc
source ~/.bashrc

# macOS (zsh):
echo 'export CLAUDE_PROFILES="cc1 ccpersonal ccapi"' >> ~/.zshrc
echo 'source ~/.config/docker-claude-code/claude-aliases.bashrc' >> ~/.zshrc
source ~/.zshrc

⁠Usage

Full syntax: <profile>-<mode> [<dir>...] [<docker-args>] -- [<claude-args>]

Each profile/account supports modes (<profile>-<mode>):

• <profile> — standard interactive mode
• <profile>-yolo — skips tool approval prompts (--dangerously-skip-permissions)
• <profile>-advisor — read-only advisory mode, no file writes (--agent advisor)

Followed by one or more directories to mount (<dir>..., default: current directory), extra docker run arguments (<docker-args>), literal --, and arguments passed through to claude (<claude-args>) (e.g. -- -p "prompt", -- --model opus).

# run interactive mode in the current directory:
cd ~/my-project
cc1

# or interactive mode with extra related directories:
cc1 . ../shared-lib1 ../shared-lib2

# or advisor/no-file-access mode:
ccpersonal-advisor

# or yolo/dangerously-skip-permissions mode with prompt:
ccapi-yolo -- -p "Please review latest changes and fix issues"

# or manually (expert):
cd ~/my-project
docker run -it --rm \
  -v "${HOME}/.claude-cc1:/home/agent/.claude" \
  -v "${PWD}:${PWD}" \
  -w "${PWD}" \
  ghcr.io/gw0/docker-claude-code:main claude

⁠Plugins and skills

Plugins and skills come pre-installed in the image and managed via Claude Code's native plugin system (use /plugin and /reload-plugins to enable them on-demand, resets on restart).

Enable plugins at startup with the ENABLE_PLUGINS env var (default: sc codemap):

ENABLE_PLUGINS="aas-essentials aas-web-wizard" cc1
ENABLE_PLUGINS="sc codemap claude-security@claude-plugins-official" cc1

⁠Env variables

• ANTHROPIC_API_KEY — Use Anthropic API key billing, can temporarily override a subscription profile
• CLAUDE_CODE_OAUTH_TOKEN — Use Claude Pro/Max/Team subscription, alternative to persisted login
• CLAUDE_IMAGE — Docker image to use (default: ghcr.io/gw0/docker-claude-code:main)
• CLAUDE_PROFILES — Space-separated profile names for alias generation (default: cc1 cc2 ccpersonal ccapi)
• ENABLE_PLUGINS — Space-separated plugin names to enable at startup (default: sc codemap)
• FORCE_RESET_SESSIONS — Set to 1 to wipe sessions/cache on container start
• DISABLE_GVISOR — Set to 1 to skip gVisor⁠ (runsc) syscall isolation
• DISABLE_SCAN — Set to 1 to skip AgentShield⁠ and unicode scans
• DISABLE_NOTICE — Set to 1 to skip the startup profile/GitHub/Git notice line
• DISABLE_RTK — Set to 1 to disable RTK⁠ token compression
• DOCKER_EXTRA_ARGS — User-controlled extra arguments passed to docker run (e.g. -e DOCKER_HOST=tcp://127.0.0.1:2375 --net host for remote dev environment) (same effect as passing <docker-args>)
• CLAUDE_EXTRA_ARGS — User-controlled extra arguments passed to claude (same effect as passing <claude-args>)

⁠Git/GitHub integration

Create a separate GitHub bot user with classic PAT. First-time setup (run via docker exec -it ... or use "!" prefix inside Claude):

# Git-only integration:
git config --global user.name "Your Bot"
git config --global user.email "[email protected]"

# Git/GitHub integration:
echo "YOUR_BOT_GITHUB_PAT" | gh auth login --with-token
gh auth setup-git
git config --global user.name "$(gh api user --jq '.name // .login')"
git config --global user.email "$(gh api user --jq '.email // "\(.login)@users.noreply.github.com"')"
git config --global author.name "Your Name"
git config --global author.email "[email protected]"

Git config and GitHub CLI auth persist in the per-profile persistent dir.

⁠Shell in a live container

One can get an ad-hoc user or root shell to install extra packages in a running container without rebuilding (changes are lost on exit unless added to Dockerfile):

docker ps --filter ancestor=${CLAUDE_IMAGE:-ghcr.io/gw0/docker-claude-code:main}
# run user shell:
docker exec -it <container> bash
# run root shell:
docker exec -u 0:0 -it <container> bash
# install apt packages:
docker exec -u 0:0 -it <container> bash -c 'apt-get update && apt-get install -y <package>'

⁠gVisor support

gVisor⁠ (runsc) adds an extra syscall-isolation layer on top of the existing hardening. Just install it as a Docker runtime and it gets used automatically (disable with DISABLE_GVISOR=1):

# debian/ubuntu:
curl -fsSL https://gvisor.dev/archive.key | sudo tee /etc/apt/keyrings/gvisor-keyring.asc
echo "deb [signed-by=/etc/apt/keyrings/gvisor-keyring.asc] https://storage.googleapis.com/gvisor/releases release main" | sudo tee /etc/apt/sources.list.d/gvisor.list
sudo apt-get update && sudo apt-get install -y runsc

⁠Insecure experiments with Docker/KinD

Docker or KinD work fastest when using the host/sidecar/remote Docker daemon. To expose the Docker socket you need to disable gVisor and consider passing requests through a restricted Docker socket proxy (to limit actions, only allow if prefix matches, deny host mounts, deny host networking...):

DOCKER_EXTRA_ARGS="-v /run/docker-restricted.sock:/run/docker.sock --group-add $(stat -c '%g' /run/docker-restricted.sock)" DISABLE_GVISOR=1 cc1

⁠Remote dev environment

Claude runs locally, edits files in the local workspace, but executes commands in the remote dev environment via Docker socket forwarding.

1. Local: Claude container runs locally, edits files in workspace, has access to forwarded local port
2. Mutagen: Syncs workspace files bidirectionally (local workspace <-> remote workspace)
3. Mutagen: Forwards local connections to remote restricted Docker socket (local port -> remote dev-docker-proxy)
4. Remote: Restrict so that only EXEC commands get to remote Docker socket (remote dev-docker-proxy -> remote Docker socket)
5. Remote: Claude executes docker exec commands that run in remote dev-container (docker exec -> ... -> dev-container)

Install dependencies:

curl -Lo mutagen.tar.gz https://github.com/mutagen-io/mutagen/releases/download/v0.18.1/mutagen_linux_amd64_v0.18.1.tar.gz
tar -xzf mutagen.tar.gz -C ~/bin

In your project dir, set up a containerized dev environment similar to remote-example/.

Start and manage a remote dev environment (via SSH):

cd ~/my-project
DOCKER_HOST=ssh://user@remote mutagen project start
mutagen project list

# management:
mutagen project resume
mutagen project terminate

Run local Claude with remote execution:

# with shell integration:
cd ~/my-project
DOCKER_EXTRA_ARGS="-e DOCKER_HOST=tcp://127.0.0.1:2375 --net host" cc1

⁠License

Copyright © 2025-2026 gw0⁠ <[email protected]⁠>. Licensed under AGPL-3.0-or-later⁠.

If my work saves you time, money, or tokens, consider sponsoring⁠ the work that keeps it maintained — and tell whoever else benefits, human or agent.