Run Claude code in docker sandbox (sbx) to ensure it only has current folder access and limited or no network access. Especially since a lot of runs are now in “auto mode”.
Unless even this is not really so safe!?
Any conversation
a constant, existential pull
so old I couldn't tell you the end
or draw its shape
between kind acceptance
and striving, struggling, writhing, climbing
learning, growing, discontent
"do you feel this way, too, at endless war with longing itself?"
but the birds and trees and ants and wind
in their own marvelous design
don't reply
Really glad to be using Haskell for work - especially in today's climate with agentic coding.
Our team uses containers to keep our development environment consistent across team members, though, and most agent sandbox approaches want to either offload your work fully to the cloud or they want to sandbox the agent harness process itself.
We're not ready for full cloud based development (yet?) and sandboxing just the agent doesn't work for us when the agent needs to run docker.

