What does --dangerously-skip-permissions do in Claude Code?

It starts Claude Code in bypassPermissions mode, so commands and file edits run without asking first. Claude Code still refuses to start this way as root, still asks before rm on critical paths, and admins can turn the mode off with disableBypassPermissionsMode. Anthropic recommends it only in isolated containers or VMs.

Is Claude Code's /sandbox enough to run with permissions skipped?

Not on its own. It sandboxes shell commands only, lets them read most of the machine including ~/.ssh, and leaves file tools, hooks and local MCP servers outside. Anthropic says it is not a complete isolation boundary and is not sufficient for fully unattended runs.

What is Codex yolo mode?

--yolo is an alias for --dangerously-bypass-approvals-and-sandbox. It turns off approval prompts and the sandbox, so commands run with danger-full-access. OpenAI says it is meant for environments that are already sandboxed, such as a container or VM.

Does OpenCode have a sandbox?

OpenCode's docs describe permissions in opencode.json but no OS sandbox, and most permissions default to allow. opencode run --auto approves anything not set to deny, so run it in a container or VM when you use it.

Is running Claude Code in Docker safe?

It is safer than running on your laptop, but the container doesn't isolate everything. The agent can still change the bind-mounted project, read any keys you pass in, and reach the network unless you add a firewall, and containers share your computer's kernel. Docker Sandboxes or a cloud VM give stronger isolation.

All resources

Guide/8 min read

How to run Claude Code in a sandbox (plus Codex and OpenCode): skip permissions safely

Published October 30, 2026

Summary

What --dangerously-skip-permissions, Codex --yolo and OpenCode --auto turn off, and how /sandbox, Docker, cloud sandboxes and Replicas contain them.

Claude Code, Codex and OpenCode ask before they run a command or edit a file. Claude Code turns those prompts off with --dangerously-skip-permissions, Codex with --yolo and OpenCode with --auto. Without prompts, an agent can work through a long task on its own. Anthropic's help text for the flag says it is "recommended only for sandboxes with no internet access."

When you turn off permission prompts, the agent runs every command without asking. On your laptop, that means a bad command can read your keys or change files outside the project. Claude Code's /sandbox, Codex's sandbox modes and Docker limit some of this, but the agent still runs on your computer. Running each task in its own cloud VM keeps it away from your files and logins. You can build that yourself on a sandbox provider such as E2B, or use a cloud agent platform like Replicas.

What an agent can access with permission prompts off, by setup

Setup

Files outside the project

Your keys and logins

The internet

Your computer

Laptop, prompts skipped

--dangerously-skip-permissions, --yolo, opencode --auto

Can change

Can read and send

Open

Same machine

Claude Code /sandbox

Shell commands only

Read, no writes

Readable, allowlist to send

Allowlist, starts empty

Same kernel

Codex workspace-write

OpenAI's default for local work

Read, no writes

Readable, no network to send

Off

Same kernel

Docker or devcontainer

Repo bind-mounted

Only what you mount

Only what you pass in

Open unless you add a firewall

Shared kernel

Cloud sandbox

E2B, Tensorlake, Modal, Vercel

None of yours

Only what you pass in

Provider setting

Separate machine

Replicas

One cloud VM per task

None of yours

Agent login, env variables, App token

Open unless you add a firewall

Separate machine

ExposedLimited, or up to youOut of reach

What --dangerously-skip-permissions, Codex yolo mode and OpenCode --auto turn off

Agent	Flag	What it does
Claude Code	`--dangerously-skip-permissions`	Starts in `bypassPermissions` mode, the same as `--permission-mode bypassPermissions`
Codex	`--dangerously-bypass-approvals-and-sandbox`, alias `--yolo`	Turns off approvals and the sandbox (`danger-full-access`)
OpenCode	`--auto`	Approves every permission not explicitly set to `deny`

With these flags on, the agent runs commands as your user. On a laptop, that means it can read ~/.ssh, ~/.aws and any API key in your shell, change files outside the project, push to any repository your git login can reach, and send any of that over the network. Anthropic's docs say bypassPermissions "offers no protection against prompt injection or unintended actions."

Prompt injection is the main risk in practice. A README, issue, web page or dependency the agent reads can contain instructions, and the agent may follow them.

Claude Code keeps a few checks in this mode:

It refuses to start as root or under sudo on Linux and macOS.
It still asks before rm on critical paths.
The first interactive run shows a warning you have to accept.
Admins can turn the mode off for everyone with disableBypassPermissionsMode in managed settings.

These checks don't stop the agent from reading a secret and sending it to another server.

Claude Code's /sandbox and Codex's sandbox modes

Claude Code and Codex can both sandbox the commands they run on your machine. They use macOS Seatbelt and Linux bubblewrap to limit which files a command can write and whether it can reach the network, so you approve fewer prompts while you work. Both sandboxes still let commands read your files, so they don't make it safe to skip permissions on a laptop.

	Claude Code `/sandbox`	Codex `workspace-write`
On by default	No. Turn it on with `/sandbox` or `sandbox.enabled`	OpenAI's docs call it the default for local work
What runs in the sandbox	Bash, PowerShell and Monitor commands	Commands the model runs
Writes	Project folder and temp folders	Project folder, `/tmp` and `$TMPDIR`. `.git`, `.codex` and `.agents` stay read-only
Reads	Most of the machine, including `~/.ssh` and `~/.aws/credentials`	Not limited. The sandbox restricts writes and network only
Network	Through a local proxy, to an allowlist that starts empty	Off unless you set `network_access = true`
Running without the sandbox	The agent can retry a blocked command unsandboxed, unless you set `allowUnsandboxedCommands: false`	`danger-full-access` or `--yolo`
Linux requirements	`bubblewrap` and `socat`	Bundled bubblewrap, with unprivileged user namespaces

Claude Code's file tools (Read, Edit, Write), web fetches, hooks and local MCP servers run outside its sandbox. Anthropic says that "sandboxing reduces risk but is not a complete isolation boundary," and that the sandboxed Bash tool on its own "is not sufficient for fully unattended runs." For a stricter setup, Anthropic's open-source sandbox runtime wraps the whole claude process (srt claude). Anthropic describes it as a beta research preview.

This .claude/settings.json turns the sandbox on, stops Claude Code from running if the sandbox can't start, blocks the unsandboxed retry, and allows network access only to npm:

json

{  "sandbox": {    "enabled": true,    "failIfUnavailable": true,    "allowUnsandboxedCommands": false,    "network": { "allowedDomains": ["registry.npmjs.org"] }  }}

Running Claude Code, Codex and OpenCode in Docker

A container gives the agent its own filesystem, so it can only see the folders you mount and the environment variables you pass in. This Dockerfile installs all three agents and runs them as a non-root user, because Claude Code refuses --dangerously-skip-permissions as root:

dockerfile

FROM node:22RUN npm install -g @anthropic-ai/claude-code @openai/codex opencode-aiUSER nodeWORKDIR /workspace

bash

docker build -t agent-box .docker run --rm -it -v "$PWD":/workspace -e ANTHROPIC_API_KEY agent-box \  claude --dangerously-skip-permissions

The same image runs Codex with --yolo and OpenCode with --auto. A container like this has three limits:

The mounted project is your real folder. Bind mounts are writable by default, so the agent's changes land on your disk immediately. The container's node user (uid 1000) also needs write access to the folder.
Credentials inside the container are readable. Anthropic's devcontainer docs say a container doesn't stop a malicious project "from exfiltrating anything accessible inside the container, including the Claude Code credentials stored in ~/.claude," and advise against mounting host secrets. The same applies to keys you pass with -e.
Codex's own sandbox may not start in a container. OpenAI's docs say it may not work when the container blocks the namespaces it needs, and to let the container provide isolation and run Codex with --sandbox danger-full-access inside it.

Plain containers don't restrict the network, and they share the host's kernel. Anthropic's reference devcontainer adds a firewall script that blocks outbound traffic except to GitHub, npm, the Anthropic API and a few other domains.

Docker Sandboxes is Docker's own product for running agents. sbx run claude starts the agent in a microVM with its own kernel, and a proxy on the host adds API keys to requests so the keys never enter the VM. It's free to run locally, supports Claude Code, Codex, OpenCode and more, and runs on macOS with Apple silicon, Windows 11 and Ubuntu 24.04 or later.

Containers and Docker Sandboxes run on your own machine, so the number of tasks you can run at once depends on its CPU and memory, and tasks stop when it sleeps.

Running agents in a cloud sandbox

Cloud sandbox providers rent you a VM billed by the second. The agent runs on their hardware, so nothing it does can reach your computer.

Provider	Isolation	List price	Longest session
E2B	Firecracker microVM (per E2B)	$0.000014 per vCPU-second and $0.0000045 per GiB-second, about $0.17 an hour for the default 2 vCPU and 4 GiB	1 hour on Hobby, 24 hours on Pro
Tensorlake	Firecracker microVM	$0.07 per core-hour, $0.015 per GB-hour	2 hours free, 24 hours on credits
Modal	gVisor	3× Modal's list CPU and memory rates	24 hours
Vercel Sandbox	Firecracker microVM	$0.128 per active CPU-hour, $0.0212 per GB-hour on Pro	45 minutes on Hobby, 24 hours on Pro

A provider gives you a VM and an SDK to control it. To run coding tasks on one, you also need to build these parts yourself.

Part	What you build
Image	The agent CLIs, your language toolchains, and enough memory. Claude Code needs 4 GB
Secrets	A way to get model keys and repository tokens into the VM without putting them in the image or logs
Git	Cloning, a git identity, and a token that can push. A fine-grained token can be limited to specific repositories
Pull requests	Opening the PR, then sending review comments and CI failures back to the agent
Triggers	Starting tasks from Slack, Linear or GitHub, and posting results back
Lifecycle	Pausing idle sandboxes, resuming them for follow-up messages, and deleting old ones

This is worth building if running agents is part of your product. For the simplest version, a rented VM with tmux, our guide to running Claude Code and Codex off your laptop walks through the setup with timings.

Running agents in Replicas

Replicas runs each task in its own cloud VM, with your repositories cloned and the agent you choose signed in. Claude Code, Codex, OpenCode and the other supported agents run there with permission prompts off. The VM doesn't have your laptop's files or logins, only the repositories and the variables you add to the environment. You can start a task from the dashboard, Slack, Linear, a GitHub or GitLab comment, the CLI or the API, and the agent opens a pull or merge request when it's done.

	How it works
Isolation	One VM per task, with 2 to 8 vCPUs and 8 to 32 GB of memory depending on size
Agents	Claude Code, Codex, OpenCode, Cursor, Pi and Muse Code, signed in with your plan or API keys
Repository access	By default, a GitHub App token that Replicas refreshes. It reaches every repository the App installation covers, not only the task's, so install the App only on repositories agents should work in. Admins can block agents from merging PRs or pushing to protected default branches
Secrets	Environment variables, files, or a Doppler or Infisical sync. Values marked sensitive aren't shown again in the app
Network	Open by default. You can restrict it with firewall rules in a start hook
Cost	Billed per minute while the VM is awake: $0.004 for `small` and $0.008 for the default `large`. Workspaces sleep after 30 idle minutes. Model usage is billed to your own plan or API key

The agent can read the variables and the agent login in its own VM, so give each environment only the secrets its tasks need. You can try Replicas with $100 of free usage, no card required.

Comparison of the sandbox options

	Isolation	Setup	Credentials the agent can read	Tasks at once	Cost
Laptop, prompts skipped	None	None	All of yours	A few, with git worktrees	Model usage only
Claude Code `/sandbox`, Codex `workspace-write`	Process sandbox on your kernel	A setting. Linux needs bubblewrap	All of yours. Sandboxed commands can only send to the allowlist, but Claude Code's web fetches and local MCP servers run outside it	A few, with git worktrees	Free
Docker or devcontainer	Container on your kernel	A Dockerfile, plus a firewall if you want one	What you mount or pass in	As many as your machine fits	Free
Docker Sandboxes (`sbx`)	microVM on your machine	Install `sbx`	None of your API keys, which stay outside the VM	As many as your machine fits	Free locally
Cloud sandbox	VM in the cloud	Your own image, secrets, git and PR code	What you pass in	Up to the provider's limit	About $0.17 an hour on E2B's default size
Replicas	VM per task in the cloud	Connect a repository and a model login	The environment's variables, the agent login and the GitHub App token	One VM per task	$0.48 an hour on the default size while awake

Secrets and network egress

A container or VM limits which of your files and keys the agent can read. Network rules limit which servers it can send them to. An agent in a VM with open network access can still send any key you gave it to another server.

Practice	Why
Give the agent keys scoped to the task, not your own logins	A fine-grained GitHub token limited to one repository, or a separate model key, can be revoked without affecting anything else
Don't mount `~/.ssh`, `~/.aws` or `~/.config/gh`	Anthropic's devcontainer docs recommend "repository-scoped or short-lived tokens" instead
Allow only the domains the task needs	Package registries and your git host cover most coding work
Be careful with broad domains	Anthropic notes that its sandbox proxy doesn't inspect TLS, so an allowed domain like `github.com` can still be used to send data out
Keep secrets out of the agent's session where you can	OpenAI's Codex cloud docs say secrets "are only available to setup scripts" and are removed before the agent runs. Docker Sandboxes keeps API keys outside the VM

In all of these setups, anything the agent reads is also sent to the model provider as part of the conversation.

Codex and OpenCode sandbox settings

Codex. The sandbox mode and the approval policy are separate settings, and both can go in ~/.codex/config.toml:

toml

sandbox_mode = "workspace-write"approval_policy = "on-request"[sandbox_workspace_write]network_access = false

Flag	What it does
`-s read-only`, `workspace-write` or `danger-full-access`	Sets the sandbox mode
`-a on-request` or `never`	Sets when Codex asks for approval. Recent versions no longer accept `untrusted` or `on-failure`
`--yolo`	Same as `--dangerously-bypass-approvals-and-sandbox`. It isn't listed in `--help`, but it still works
`--add-dir <dir>`	Adds a writable folder without turning the sandbox off

Recent versions also removed --full-auto. On Linux, Codex sandboxes commands with bubblewrap and seccomp.

OpenCode. OpenCode's docs describe permission rules but no OS sandbox, so run it in a container or VM whenever you use --auto. Most permissions default to allow. Only external_directory, doom_loop and reading .env files ask by default. You can make it stricter in opencode.json: