Enclave CLI
A container for Claude Code, Codex, Copilot, OpenCode and Pi: the agent runs without prompts while a gateway limits network.
- 80 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- The agent runs without prompts in a container: it may change files in the mounted project and reach allowlisted domains.
Install
- Works in
Manual install
sudo apt install ./enclave_*_amd64.debThe package comes from the latest release, with an `.rpm` for Fedora. Then `enclave` in the project directory.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The agent runs without prompts in a container: it may change files in the mounted project and reach allowlisted domains.
This is third-party code. Review the repository files before installing.
What it does
The `enclave` command starts the chosen agent in a Docker or Podman container, one per session. The agent sees the project worktree and the directories you add, and the rest of the machine stays out of reach. Prompts are off: the agent runs in YOLO mode, and the container is what limits it. All network traffic goes through a gateway that passes only allowlisted domains and logs what it allows and blocks, shown by `enclave network log`. Secrets the gateway inserts into requests reach the container only as placeholders. Logins, config, history and agent memory persist on the host across sessions. Background sessions (`--background`, `enclave attach`), a shell in the container and the Theia IDE are available.
Who it is for. Developers who want to give an agent full autonomy on a long task without letting it touch the home directory, keys and arbitrary sites.
Good fit when
- An agent rewrites a large module overnight with no prompts and rights limited to the project.
- You want to see where the agent tried to reach on the network, through `enclave network log`.
- Claude Code and Codex work a project in turn with shared history and logins.
- A session goes to the background and is joined later through `enclave attach`.
Not a fit when
- Neither Docker nor Podman is available, and without a container the tool does not run.
- The agent needs your whole home directory, which Enclave refuses to mount.
- You need full virtual-machine isolation with no compromises: the QEMU backend is still experimental.
Example request
Start Claude Code in Enclave in this project and show which domains the agent tried to open.Limitations
It runs on Linux, macOS and Windows through WSL2 and needs Docker with buildx or Podman and Git 2.26 or newer with an author name and email configured, otherwise startup stops. The tool refuses to run as root. The container limits the agent but is not absolute protection: what is covered and what is not is described in the Security section of the docs. An agent without prompts may change and delete files in the mounted project, so keep commits. Extra agents such as Amp and Antigravity are installed separately from the extensions repository.
How to disable. Stop sessions found with `enclave ps`, then remove the package with `sudo apt remove enclave` or delete the binary. The configuration is in `~/.config/enclave/config.json`.
FAQ
How do I start a different agent?
Pick it on the first run or pass `enclave --tool codex` for one session. The choice is saved as `tool` in `~/.config/enclave/config.json`.
What can the agent see on the machine?
The project worktree and the directories you added. Enclave refuses to mount the home directory and other sensitive paths.
How do I see where the agent went on the network?
Run `enclave network log`: the log shows the requests the gateway allowed and blocked.
Does the previous session continue?
Yes, `enclave continue` resumes the latest session, and logins, history and agent memory persist on the host.
How do I update Enclave?
Standalone Linux and macOS binaries update with `enclave self-update`. The `.deb` and `.rpm` packages are installed again from a release.
Discussion
No questions or reviews yet.
Related
CLI toolsExitBox runs Claude, Codex, Cursor and other agents in rootless containers: a domain allowlist and secrets in an encrypted vault.
AgentBox runs Claude Code, Codex and Open Code in separate virtual machines on your PC, a self-hosted server or a cloud.
Brig runs Claude Code and other coding agents inside an isolated microVM on your machine with access to one project only.
A CLI that runs Claude Code and Codex in isolated Docker containers with a firewall, worktrees and a no-Dockerfile image.
ArcBox runs Claude Code in a disposable microVM on a Mac: its own kernel, an empty workspace and a start in about a second
ClaudeBox runs Claude Code in Docker with language profiles, session slots and a firewall with an allowlist of addresses.
README in short
The README gives a four-step model, a quick start with prerequisite checks, installation and a command table. Separate sections point to docs on networking, auth, sessions, extensions, backends and security.