Skip to content

v0.1.0 - Initial Release

Latest
Latest

Choose a tag to compare

View all tags
@vinayprograms vinayprograms released this 17 Jan 05:43
· 6 commits to main since this release
v0.1.0
b63c709

Security-hardened container for running Claude Code with network isolation and defense-in-depth protections.

Features

  • Network Isolation - All traffic routes through Squid proxy with domain allowlist
  • Payload Size Limit - Max 50MB per request to prevent bulk exfiltration
  • Read-only Filesystem - Container can't persist malware
  • Capability Dropping - No privilege escalation possible
  • Plugin Security - Warning banner at startup, staging to avoid macOS issues
  • Docker & Podman Support - Works with both container runtimes on macOS
  • Credential Management - Supports 1Password, age encryption, or plaintext
  • Multi-instance - Run multiple claudebox sessions sharing one proxy
  • Proxy Auto-reload - Allowlist changes apply without restart
  • Audit Logging - Command logging to claudebox-logs/

Security Model

Proxy allowlist is the primary security boundary. Even if a malicious NPM package runs inside the container, it can only reach explicitly allowed domains.
Additional controls: 50MB payload limit, ~64KB/s rate limiting, read-only filesystem, dropped capabilities.

Known Limitations

  • macOS file read errors - Parallel subagent reads can overwhelm VM file sharing layer (transient, retry usually works)
  • Git push blocked by default (security feature)

Quick Start

  git clone https://github.com/vinayprograms/claudebox.git
  cd claudebox
  ./claudebox
Assets 2
Loading