Claude Cage: Docker Sandbox for Claude Code Security
What Claude Cage Does
A developer on r/ClaudeAI built a Docker container called Claude Cage to address security concerns when using Claude Code. The tool locks Claude into a single workspace folder, preventing it from accessing sensitive files outside that directory.
Security Problem Identified
The developer realized that every shell command Claude Code runs has the same permissions as the user account. This means Claude can read:
- ~/.ssh directory
- ~/.aws credentials
- Browser profiles
- Personal files
- .env files from other projects
How Claude Cage Works
The Docker container restricts Claude to seeing only your code and nothing else. It ships with:
- A claude md that loads every session with security rules including:
- No writing secrets to files
- No force-pushing
- No running destructive commands without confirmation
- A settings.json that blocks dangerous bash patterns
Setup and Development
Setup takes about 2 minutes if you have Docker installed. The developer used Claude Code to help build and polish the tool, and is open to suggestions for additional security rules.
The GitHub repository is available at: https://github.com/jcdentonintheflesh/claude-cage
📖 Read the full source: r/ClaudeAI
👀 See Also
Sieve: Local Secret Scanner for AI Coding Tool Chat Histories
Sieve scans Cursor, Claude Code, Copilot, and other AI coding assistant chat histories for leaked API keys and tokens. All scanning is local, with redaction and macOS Keychain vault.
Securing OpenClaw Infrastructure with Pomerium Identity-Aware Proxy
Use Pomerium as an identity-aware proxy for zero-trust authentication to secure OpenClaw server access.
CVE-2026-LGTM: When AI Agents Trust Each Other and Break Everything
A satirical but realistic incident report shows how seven AI security gates failed to stop a malicious package, leading to credential exfiltration and a $1.7M inference bill.
Litellm PyPI Package Compromised: Malicious Version 1.82.8 Exfiltrated Credentials
The litellm PyPI package, which unifies calls to OpenAI, Anthropic, Cohere and other LLM providers, was compromised with malicious version 1.82.8 that exfiltrated SSH keys, cloud credentials, API keys, and other sensitive data for about an hour.