ClaudeBox CLI
ClaudeBox runs Claude Code in Docker with language profiles, session slots and a firewall with an allowlist of addresses.
- 1,173 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The container constrains the agent, but the `--enable-sudo` and `--disable-firewall` flags remove protection.
- On first run the installer sets up Docker and changes non-root access.
Install
- Works in
Manual install
./claudebox.runDownload the installer from GitHub Releases: `wget https://github.com/RchGrav/claudebox/releases/latest/download/claudebox.run`, then `chmod +x claudebox.run`.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The container constrains the agent, but the `--enable-sudo` and `--disable-firewall` flags remove protection.
- On first run the installer sets up Docker and changes non-root access.
This is third-party code. Review the repository files before installing.
What it does
ClaudeBox wraps Claude Code in an isolated container. Each project gets its own image, settings, history and login state, and the container itself is temporary. The `claudebox create` command creates a slot, `claudebox slot 1` launches it, and several slots can run at once. Profiles install the needed tools: `claudebox profile python ml`, `claudebox profile rust go`. They include core, build-tools, c, rust, python, go, flutter, javascript, java, ruby, php, devops, database, datascience and others. Dependencies resolve themselves, for example C pulls in build-tools. The network firewall passes only addresses from a list edited with `claudebox allowlist`. The `claudebox shell` command opens zsh inside the container, `claudebox install htop vim` adds packages, and the `--clipboard` flag on macOS bridges image clipboard access.
Who it is for. Developers on Linux and macOS who want to keep Claude Code in a container and not give it access to the whole home folder.
Good fit when
- A Rust and Go project needs a separate environment that must not clutter the system.
- Two sessions run at once in different projects and login state must be separate.
- The agent may reach only a few domains from a list.
- A dev environment must reproduce on another machine with one command.
Not a fit when
- Docker is unavailable: ClaudeBox does not start without it, and Windows also needs WSL2.
- You need voice notifications and a graphical environment: the container does not bridge them.
- The `--disable-firewall` and `--enable-sudo` flags would remove the protection the container is for.
Example request
Create a slot with `claudebox create`, add the python and ml profiles and launch Claude Code in a container for this project.Limitations
Docker is required (on first run the installer sets it up and configures non-root access), plus Bash and Linux or macOS, Windows through WSL2. The container constrains Claude Code, but the `--enable-sudo` and `--disable-firewall` flags remove protection, and the `claudebox save` command can store them as defaults. The `--clipboard` mode on macOS raises a local bridge on a loopback address with a session token. The source version is 2.0.1 and the released archive may be older. The last commit dates from September 2026.
How to disable. A slot is removed by `claudebox revoke`, and project images and data are cleaned through the `claudebox clean` menu. Remove ClaudeBox itself with `~/.claudebox/` and the `~/.local/bin/claudebox` link.
FAQ
How do I install ClaudeBox?
Download `claudebox.run` from the releases, make it executable and run it: it unpacks to `~/.claudebox/source/` and creates `~/.local/bin/claudebox`.
What is a slot?
A persistent Claude session directory for a project. Slots share the image and environment, but each has its own login, history and settings.
How do I install languages and tools?
With `claudebox profile python go` for profiles and `claudebox install htop vim` for single packages; `claudebox profiles` lists them.
How do I limit network access?
The container firewall passes addresses from a list. View and edit it with `claudebox allowlist`.
Can I work on several projects at once?
Yes. Each project has its own image and data, and a project can hold several slots.
Discussion
No questions or reviews yet.
Related
CLI toolsArcBox runs Claude Code in a disposable microVM on a Mac: its own kernel, an empty workspace and a start in about a second
AgentBox runs Claude Code, Codex and Open Code in separate virtual machines on your PC, a self-hosted server or a cloud.
A CLI that runs Claude Code and Codex in isolated Docker containers with a firewall, worktrees and a no-Dockerfile image.
ExitBox runs Claude, Codex, Cursor and other agents in rootless containers: a domain allowlist and secrets in an encrypted vault.
A container for Claude Code, Codex, Copilot, OpenCode and Pi: the agent runs without prompts while a gateway limits network.
Brig runs Claude Code and other coding agents inside an isolated microVM on your machine with access to one project only.
README in short
A Bash utility with Docker, source version 2.0.1. The `claudebox.run` installer puts it in the home directory, and commands manage slots, profiles, packages and the allowed-address list.