Skip Permissions Safely: Run Claude Code in Full-Autonomy Mode Inside a Locked-Down Docker Container

A deny-all Docker container makes --dangerously-skip-permissions safe: Claude gets full autonomy inside an isolated filesystem and network wall, never touching your host machine.

--dangerously-skip-permissions removes every approval dialog -- Claude can read, write, and execute without asking. On your laptop that means it can touch all your files and make any network request. Inside a container it can only touch what you explicitly mounted, and only reach the network endpoints you allow.

This matters even more after today's v2.1.223 patches, which fixed two permission-bypass bugs. Container isolation is defense-in-depth: even if a future bypass exists, a sandboxed Claude cannot escape to your host.

Three paths to a sandboxed session

Option 1: Docker Desktop sbx launcher (fastest)

Docker Desktop 4.40+ ships a built-in sandbox launcher. One command gives you an isolated Claude Code environment:

docker sbx run anthropic/claude-code@latest --dangerously-skip-permissions

The launcher mounts your current directory into /workspace, installs a deny-all outbound firewall that permits only the Anthropic API and npm registry, and removes the container on exit.

Option 2: Anthropic official devcontainer feature (best for VS Code teams)

Add .devcontainer/devcontainer.json to any project:

{
  "name": "Claude Code Sandbox",
  "image": "mcr.microsoft.com/devcontainers/base:ubuntu-24.04",
  "features": {
    "ghcr.io/anthropics/claude-code-features/claude-code:latest": {}
  },
  "postCreateCommand": "npm install --prefix /workspace",
  "remoteEnv": {
    "ANTHROPIC_API_KEY": "${localEnv:ANTHROPIC_API_KEY}"
  }
}

Open in VS Code with the Dev Containers extension and run claude --dangerously-skip-permissions in the integrated terminal. Your project files are mounted read-write; everything else on your host is unreachable.

Option 3: Manual Dockerfile with firewall (most control)

For tighter control -- allow npm and GitHub but block everything else:

FROM ubuntu:24.04
RUN apt-get update && apt-get install -y nodejs npm nftables curl
RUN npm install -g @anthropic-ai/claude-code
COPY firewall.sh /usr/local/bin/firewall.sh
RUN chmod +x /usr/local/bin/firewall.sh
ENTRYPOINT ["/usr/local/bin/firewall.sh"]
CMD ["claude", "--dangerously-skip-permissions"]

# firewall.sh -- allow only Anthropic + npm, deny all else
nft add table inet filter
nft add chain inet filter output '{ type filter hook output priority 0 ; policy drop ; }'
nft add rule inet filter output ip daddr 18.157.0.0/16 accept
nft add rule inet filter output ip daddr 104.16.0.0/12 accept
nft add rule inet filter output ct state established accept

Run it with:

docker build -f Dockerfile.claude-sandbox -t claude-sandbox .
docker run -it --rm   -v "$(pwd)":/workspace   -e ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY"   --cap-add NET_ADMIN   claude-sandbox

What the container buys you

Threat	Without container	With container
Claude reads ~/.ssh	Possible	Blocked -- not mounted
Claude exfiltrates to attacker server	Possible	Blocked -- deny-all firewall
Permission bypass bug	Exploitable	Contained to workspace only
Runaway file deletions	Host filesystem	Only mounted project dir

The setup takes under 10 minutes. For any team running Claude Code in auto-approve mode on production code, it is the right foundation.

Sources: Docker Sandboxes blog -- Docker.com . Trail of Bits devcontainer for Claude Code . Run Claude Code Sandboxed -- DEV Community . Claude Code on the web docs