Agent Sandbox Kit: Locked-Down Docker for Claude Code and Codex CLI

The Agent Sandbox Kit runs Claude Code and Codex CLI inside a Docker container that can reach only the hosts you list. The agent runs as a non-root user on a read-only root filesystem with every Linux capability dropped, sees exactly one project directory, and has no route to the internet except a Squid proxy that refuses anything not on egress/allowlist.txt. Every request the agent makes is written to the proxy log, so you can read afterwards what it tried to reach. It is built for developers who run --dangerously-skip-permissions or long unattended agent tasks and do not want to hand the agent their laptop.

Tested on 13 October 2026 with Claude Code 2.1.296 and Codex CLI 0.162.1. Both images were built from scratch with no cache, the 11-check smoke test passed three times in a row, and both CLIs reached their APIs through the proxy: deliberately invalid keys came back as 401 responses, not network errors. VERIFY.md in the zip records the exact commands and the output they produced.

What You Get

• Dockerfile — the agent image on node:22-trixie-slim with git, ripgrep, curl, Python 3 and both CLIs pinned through build arguments. Self-updates are disabled, so you upgrade by rebuilding.
• compose.yml — the agent and egress services on an internal-only network with no gateway: read-only rootfs, all capabilities dropped, no-new-privileges, a 512-process limit, a 4 GB memory limit, a 2-CPU limit, tmpfs for /tmp and home, and named volumes for ~/.claude and ~/.codex. Every line is commented.
• egress/ — Squid on Alpine running as the squid user, a default-deny squid.conf that also refuses loopback, raw IP addresses and the cloud metadata range, and allowlist.txt seeded with api.anthropic.com, api.openai.com, registry.npmjs.org, pypi.org, files.pythonhosted.org and github.com, plus commented optional hosts for subscription and ChatGPT sign-in.
• scripts/sandbox.sh — up, shell, run, claude, codex, logs, reload, check-git and down. It creates .env with mode 600, refuses to mount /, your home directory, the kit itself or any project containing .ssh, .aws, .gnupg, .kube, .docker or gcloud credentials, and never mounts the Docker socket.
• scripts/smoke-test.sh — 11 PASS/FAIL checks: runs as uid 1000, write to / refused, non-allowlisted host blocked, allowlisted host answers through the proxy, direct connection bypassing the proxy has no route, raw IP through the proxy blocked, external DNS lookups fail, no Linux capabilities, no-new-privileges set, the egress log recorded the blocked request, and both CLIs run on the read-only image.
• config/codex-config.toml — system-level Codex defaults: background daemon auto-start off, startup update check off.
• secrets/RUNBOOK.md — key scoping, rotation, what to do after a suspected leak, and how to read the audit log.
• README, VERIFY.md, CHANGELOG and a single-buyer commercial licence.

How to Use

1. Unzip, commit the project you want the agent to work on, then run scripts/sandbox.sh up ~/code/my-project. The first run builds both images (about 1.5 GB) and creates .env from .env.example.
2. Uncomment one key line in .env (ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, CODEX_API_KEY or OPENAI_API_KEY) and run up again.
3. Run scripts/smoke-test.sh. All 11 checks must say PASS on your machine before you trust the sandbox.
4. Work with scripts/sandbox.sh claude or scripts/sandbox.sh codex. When the agent needs a new host, add it to allowlist.txt and run reload.
5. Finish with scripts/sandbox.sh down: it checks the project's git metadata, saves the audit log and stops the containers.

Who This Is For

• Developers running Claude Code or Codex unattended, with permission prompts off, who want the blast radius limited to one directory and a short list of hosts.
• Teams that need an audit log of every host an agent contacted during a task.
• Anyone who read about prompt-injection exfiltration through package installs or curl and wants a default-deny answer rather than a longer deny-list.
• Solo founders who keep client code and personal credentials on the same machine.

Read the limits before you rely on it. This release was tested only on Docker Desktop for macOS on Apple silicon. Linux, x86_64 and Windows hosts should behave the same but were not run, which is why the smoke test ships. No real model session ran during testing, only the network path and authentication rejection. Codex's own bubblewrap sandbox cannot start inside the hardened container, so the kit sets sandbox_mode = "danger-full-access" for Codex and makes the container the boundary; the README explains the trade-off. Pair it with the Claude Code Spend Guard for a hard daily cost cap, plan a budget with the free Agent Run Cost Simulator, and see the other packs in best Claude Code configs or browse everything at /browse.