Claude Cage: Docker Sandbox for Claude Code Security
What Claude Cage Does
A developer on r/ClaudeAI built a Docker container called Claude Cage to address security concerns when using Claude Code. The tool locks Claude into a single workspace folder, preventing it from accessing sensitive files outside that directory.
Security Problem Identified
The developer realized that every shell command Claude Code runs has the same permissions as the user account. This means Claude can read:
- ~/.ssh directory
- ~/.aws credentials
- Browser profiles
- Personal files
- .env files from other projects
How Claude Cage Works
The Docker container restricts Claude to seeing only your code and nothing else. It ships with:
- A claude md that loads every session with security rules including:
- No writing secrets to files
- No force-pushing
- No running destructive commands without confirmation
- A settings.json that blocks dangerous bash patterns
Setup and Development
Setup takes about 2 minutes if you have Docker installed. The developer used Claude Code to help build and polish the tool, and is open to suggestions for additional security rules.
The GitHub repository is available at: https://github.com/jcdentonintheflesh/claude-cage
📖 Read the full source: r/ClaudeAI
👀 See Also
Agent Isolation Security Analysis: From No Sandbox to Firecracker VMs
Analysis of how Cursor, Claude Code, Devin, OpenAI, and E2B isolate agent workloads, ranging from no sandbox to hardware-isolated Firecracker microVMs. Container runtimes have had escape CVEs annually since 2019, while Firecracker has zero guest-to-host escapes in seven years.
Claude's Conversation Search Tool Still Returns Deleted Chats
A Claude Pro user discovered that deleted conversations remain retrievable through Claude's conversation search tool, returning substantive content including titles, message counts, and excerpts despite the chat links being dead.
OpenClaw Skill Analyzer: Static Security Scanner for AI Agent Skills
A developer built a static analyzer that scans OpenClaw skills for security risks before installation, with 40+ detection rules across 12 categories including prompt injection and data exfiltration.
LLM-Assisted Exploit: Anthropic's Mythos Preview Helped Build First Public macOS Kernel Exploit on Apple M5 in Five Days
Using Anthropic's Mythos Preview, security firm Calif built the first public macOS kernel memory corruption exploit on Apple's M5 silicon in five days—breaking MIE hardware security that took Apple five years to develop.