Chore/update

README.md

@@ -337,6 +337,7 @@ More examples in the [`examples/`](examples/) directory:
 | Injects API key via network interception hook (TypeScript) | [`examples/typescript/network_interception/`](examples/typescript/network_interception/) |
 | Claude Code CLI in micro-VM with GitHub bootstrap | [`examples/claude-code/`](examples/claude-code/) |
 | Claude Code with Docker inside sandbox via SDK | [`examples/claude-code-with-docker/`](examples/claude-code-with-docker/) |
+| Claude Code with Claude Pro/Max subscription in the sandbox | [`examples/claude-danger/`](examples/claude-danger/) |
 | OpenAI Codex CLI in micro-VM with GitHub bootstrap | [`examples/codex/`](examples/codex/) |
 | Docker daemon inside sandbox with systemd | [`examples/docker-in-sandbox/`](examples/docker-in-sandbox/) |
 | Streamlit chatbot using Agent Client Protocol | [`examples/agent-client-protocol/`](examples/agent-client-protocol/) |

RELEASE.md

@@ -1,5 +1,10 @@
 # Release Notes
 
+## 0.2.9
+
+* Fixed Linux `--allow-host` DNS reachability for intercepted sandboxes by adding a host-side DNS forwarder and nftables redirection for guest DNS queries ([#94](https://github.com/jingkaihe/matchlock/issues/94), initial contribution by [@nemtsov](https://github.com/nemtsov)).
+* Improved Linux interception reliability by binding proxy services to the sandbox gateway IP, applying secret-related allowed hosts before firewall setup, and falling back across configured DNS resolvers when an upstream fails.
+
 ## 0.2.8
 
 * Added custom secret placeholder support across `matchlock run` and the Go, Python, and TypeScript SDKs, including `--secret-placeholder`, `--secret-file`, and builder helpers for caller-defined in-VM placeholder values.

VERSION.txt

@@ -1 +1 @@
-0.2.8
+0.2.9

examples/claude-danger/Dockerfile

@@ -0,0 +1,18 @@
+FROM ubuntu:24.04
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV HOME=/home/agent
+ENV PATH=/home/agent/.local/bin:/home/agent/.claude/local:$PATH
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
+  ca-certificates \
+  curl \
+  git \
+  && useradd -m -s /bin/bash agent \
+  && install -d -m 700 -o agent -g agent /home/agent/.claude \
+  && install -d -m 755 -o agent -g agent /home/agent/workspace \
+  && su agent -c 'HOME=/home/agent bash -lc "curl -fsSL https://claude.ai/install.sh | bash"' \
+  && apt-get clean \
+  && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /home/agent

examples/claude-danger/README.md

@@ -0,0 +1,50 @@
+# Claude Code with Claude Pro/Max Subscription in the Sandbox
+
+Run Claude Code inside a Matchlock sandbox using your local Claude subscription credentials, while keeping the real subscription token on the host and injecting it with HTTP interception.
+
+## Prerequisites
+
+Build the example image
+
+Using Docker:
+
+```bash
+docker build -t claude-danger:latest examples/claude-danger
+docker save claude-danger:latest | matchlock image import claude-danger:latest
+```
+
+Or using Matchlock:
+
+```bash
+matchlock build -t claude-danger:latest --build-cache-size 30000 examples/claude-danger
+```
+
+Ensure you are logged into Claude locally and have `~/.claude/.credentials.json`.
+
+## Run
+
+From the repository root:
+
+```bash
+./examples/claude-danger/claude-danger
+```
+
+Optional flags:
+
+```bash
+./examples/claude-danger/claude-danger \
+  --cpus 4 \
+  --memory 8192 \
+  --image claude-danger:latest \
+  --credentials-file ~/.claude/.credentials.json \
+  --allowed-host api.anthropic.com \
+  --allowed-host platform.claude.com
+```
+
+The script uses `matchlock` from `PATH` by default. Override with `MATCHLOCK_BIN=/path/to/matchlock` if needed.
+
+## Notes
+
+- The image installs Claude Code with Anthropic's official installer.
+- By default the helper launches Claude Code with `claude-opus-4-6` and `--effort high`.
+- By default it allows all outbound hosts (`*`). Pass one or more `--allowed-host` flags to restrict egress.