Skip to content

README.md

Latest commit

 

History

History
60 lines (36 loc) · 2.75 KB

README.md

File metadata and controls

60 lines (36 loc) · 2.75 KB
Raw

Coding Agent Sandbox

Run your coding agent in a sandbox for full control over what it is able to see.

Sandboxes included:

  1. Claude Code via claude-sandbox-template.sh
  2. OpenCode via opencode-sandbox-template.sh

How To Prepare

Depending on your preferences, copy one of the templates to your project directory and make it executable (chmod u+x opencode-sandbox.sh). Adjust the list of files and folders that should be shared to the container as volume mount. The template script scaffolds the agent setup and creates a directory for agent data and a basic settings file. Those becomes part of your project and should be tracked by your version control.

Each template script will build a container image if not already exists, and runs it in a sandbox.

Extend your project documentation about how to use the sandbox script.

Code-Sharing

(!) Never share confident or sensitive data like person related information to the coding agent.

You also don't need to share lib sources like node_modules/ or vendor/ to keep the context clean. Be aware that a folder is shared recursively. You may need to hide sensitive data that is nested in a shared folder. Mount those to your hosts /dev/null:

  -v "$(pwd)/dev/null:/workspace/path/to/file/i/dont/want/to/share.txt"

First Run

The very first thing you'll do after setting up your shares properly and after authenticating your account, is initializing the project for the coding agent. Most agents provides a /init command. This results in a project description (or interpretation) in the AGENTS.md (Claude Code uses CLAUDE.md). Usually you initialize the project just once.

Following Runs

By default the sandbox script always creates a new container based on the container image. If you prefer to re-use the container, just remove the --rm option from docker run in the sandbox script (remove the entire line --rm \).

Update The Agent

The sandbox script does not have an update mechanism. To update the client you have to re-build the container image. To do so stop the running container, delete it and delete the container image too. The container image will be re-built on the next sandbox start.

For the default container name and container image name use:

# Claude Code
docker rm claude-sandbox
docker rmi claude-sandbox
# OpenCode
docker rm opencode-sandbox
docker rmi opencode-sandbox

Claude Code

Start the sandbox via ./claude-sandbox.sh. Claude code guides you through the settings and authentication process.

OpenCode

Start the sandbox via ./opencode-sandbox.sh. If available use the /connect command to authenticate your Zen account by providing the API key. Or just use the free models.

(!) Be aware that those will use your data for model training.