Sandboxed Claude

compose.override.yaml

services:

  claude:
    build: .
    container_name: claude
    stdin_open: true
    tty: true
    volumes:
      - ${WORKSPACE_LOCAL:-.}:${WORKSPACE_DOCKER:-/workspace}
      - ~/.claude:/home/claude/.claude
      - ~/.claude.json:/home/claude/.claude.json
    working_dir: ${WORKSPACE_DOCKER:-/workspace}

Dockerfile

FROM ubuntu:25.10

RUN apt-get update && apt-get install -y \
    git \
    curl \
    unzip \
    # Playwright/Chromium dependencies \
    libnss3 \
    libnspr4 \
    libatk1.0-0 \
    libatk-bridge2.0-0 \
    libcups2 \
    libxkbcommon0 \
    libatspi2.0-0 \
    libxcomposite1 \
    libxdamage1 \
    libxfixes3 \
    libxrandr2 \
    libgbm1 \
    libpango-1.0-0 \
    libasound2t64 \
    && rm -rf /var/lib/apt/lists/*

RUN useradd -m -s /bin/bash claude

USER claude
ENV HOME=/home/claude

RUN curl -fsSL https://bun.sh/install | bash
ENV PATH="/home/claude/.local/bin:/home/claude/.bun/bin:$PATH"

RUN bun i -g @anthropic-ai/claude-code && \
    mkdir -p /home/claude/.local/bin && \
    ln -s /home/claude/.bun/bin/claude /home/claude/.local/bin/claude

USER root
RUN ln -s /home/claude/.bun/bin/bun /usr/local/bin/node

USER claude
ENTRYPOINT ["claude"]