Runs Claude Code inside a container that only sees your project folder. Your login, sessions, MCP servers and plugins stay on your machine and survive restarts and rebuilds.
Technical details
Shell wrapper over Docker (trixie-slim Debian + Node/NVM, pnpm, uv and a pinned native Claude Code binary) running as your UID/GID with --cap-drop=ALL and no-new-privileges. The policy is generated on the host and reaches the container read-only as /etc/claude-code/managed-settings.json (permissions.deny/ask, PreToolUse hooks and opencode-policy patterns) in strict/balanced/none modes; updates require signed releases verified against pinned keys, with image and checkout rollback. Opt-in hardening profiles plus a fingerprint diff of the persistent paths after every session.
Shell Docker Debian Claude Code Node.js
Highlights
Read-only managed-settings.json that user settings cannot relax
Signed updates with image and checkout rollback
Auth, sessions, MCP and plugins persist under ~/.config/claude-dockerized/home