Container by Aerovato CLI
Container
A CLI for persistent per-project Linux workspaces in Docker or Podman that keep the agent away from the rest of your system
- 382 ★ on the repository
- Last commit
- BSD-3-Clause
Broad access
Why this level
- The project is mounted read-write, so the agent can change or delete files in it
- Enabled configurations and optional credentials are available inside the container
- The container keeps network access
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/containerDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The project is mounted read-write, so the agent can change or delete files in it
- Enabled configurations and optional credentials are available inside the container
- The container keeps network access
This is third-party code. Review the repository files before installing.
What it does
Container creates a separate Docker or Podman environment for each project, with coding agents and development tools already installed. The environment persists between sessions, so packages and settings installed inside stay put. The agent works only inside the project and cannot see the rest of your system. Container mounts the project folder at /root/<project name>. Running container with no arguments opens the workspace of the current folder, and container run with a path opens any other project. container list shows managed containers, while container stop and container remove stop and delete a workspace. Setup starts with container init, which asks which agents, tools, runtime and mounts to use and builds the first image. Your own packages and setup commands go into ~/.code-container/Dockerfile.User, and container build user rebuilds the image. Other settings live in ~/.code-container/settings.json. The environment works the same on Windows, macOS and Linux, and no account is needed.
Who it is for. For developers who run Claude Code, Codex or OpenCode with broad permissions and want to keep them inside a per-project container.
Good fit when
- The agent needs broad permission to run commands, but should not reach your home folder or other projects
- You want the same development environment on Windows, macOS and Linux
- Packages and project settings must survive stopping the container and starting it again
- Several terminals need to attach to one environment
- You want to extend the base image with your own packages and setup commands
Not a fit when
- You need protection from prompt injection or from the agent's own mistakes: the author states plainly that the container does not provide it
- The project folder holds data with no copy: it is mounted read-write and the agent can change or delete files in it
- You have neither Docker nor Podman: the workspace cannot be created without one of them
- The agent must have no network access: containers keep network access
Example request
Open this project's workspace in Container, add Python 3.12 through Dockerfile.User and rebuild the imageLimitations
Docker or Podman is required on Windows, macOS or Linux. The first image is built after container init, and agents, tools, runtime and mounts are chosen at that step. New packages reach the environment only after an image rebuild.
Isolation narrows what the agent sees of your system. The container gives no protection from prompt injection or the agent's own mistakes, so the author advises keeping important work under version control and mounting only the resources the agent needs.
The configuration skill works only on the host: agents inside the container cannot see Container's configuration.
How to disable. Stop the workspace with container stop and delete it with container remove. Remove the program the way you installed it: npm uninstall -g @aerovato/container for the npm install. Settings live in the ~/.code-container folder.
FAQ
How do I install Container?
On macOS and Linux run curl -fsSL https://container.aerovato.com/install.sh | sh; on Windows run irm https://container.aerovato.com/install.ps1 | iex in PowerShell. You can also install through npm with npm install -g @aerovato/container. Then run container init.
Where does my project live inside the container?
At /root/<project name>. The folder is mounted read-write, so every edit the agent makes lands in the project on the host.
How do I add my own packages?
Put packages and setup commands in ~/.code-container/Dockerfile.User and run container build user. Shared images rebuild with container build, container build tools and container build harness.
Can I let an agent configure Container for me?
Yes, a portable skill exists for it: npx skills add aerovato/container --skill container, with --global for all projects. With it the agent configures packages, mounts and permissions itself.
Can I attach to the workspace from a second terminal?
Yes, several terminals can enter the same container at once. container run with a folder path opens another project's workspace.
Discussion
No questions or reviews yet.
Related
CLI toolsContainarium: isolated boxes for AI agents
Containarium
A platform on your own server that gives each agent its own Linux box with SSH and MCP tools for commands and files
A Docker Desktop replacement for Apple Silicon Macs with a built-in MCP server for AI agent sandboxes
1C AI sandbox client-server
1c-ai-sandbox-client-server
A devcontainer plus a Hyper-V VM with a 1C server that isolate an AI agent from the host machine so a wrong command cannot touch real files or drives
Docker Skills
docker-skills
Official Docker skills for agents: Dockerfile and builds, Compose, Sandboxes, Docker Agent and a skill that confirms irreversible actions
Docker MCP by QuantGeekDev
docker-mcp
Docker MCP: an agent creates containers, deploys Docker Compose stacks from YAML, reads logs and lists containers. Runs through uvx for Claude Desktop
MCP server for managing Docker in natural language: containers, images, networks and volumes, including remote hosts over SSH
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Container by Aerovato (this entry) | no | 382 | ||
| container-use | yes | not required | 4,079 | gives each agent its own container and git branch for parallel work |
| AIO Sandbox | no | key is optional | 6,247 | an all-in-one sandbox with a browser, shell and files |
README in short
The description is short: installation for three systems, first-time setup, a command list and a security section with a direct warning about limits. The author maintains the repository with Operator Memory, and reader documentation sits in the .operator-shared folder.