claude-docker

Run Claude Code in a container that inherits your setup but not your filesystem. Workspace access is scoped to the directories you pass in; your statusline, skills, agents, and slash commands ride along as read-only bind-mounts. CLI tools are preinstalled (gh, glab, aws, az with the azure-devops extension, openspec, uv, pnpm, tfenv, git-lfs, task) plus a version-pinned Go toolchain (go) — other language runtimes are not: tfenv and uv fetch your project-pinned Terraform / Python on demand. Host credentials (gh, glab, aws, tfe, az) are opt-in per flag; nothing leaks in by default.

The VCS and cloud CLIs (gh, glab, aws, az) need a flag to see host credentials — see Credential opt-in. The rest work out of the box.

Install

# Build the image from your checkout (one-time; rerun after Dockerfile or tool pins change)
docker build -t claude-code:local .

# Put on your PATH (create ~/bin if it doesn't exist)
mkdir -p ~/bin
ln -s "$(pwd)/run.sh" ~/bin/claude-docker

The build needs BuildKit (the Dockerfile uses COPY --chmod). Docker Desktop ships it by default. A Homebrew docker CLI with…