# How to run Claude Code in a sandbox (plus Codex and OpenCode): skip permissions safely

What --dangerously-skip-permissions, Codex --yolo and OpenCode --auto turn off, and how /sandbox, Docker, cloud sandboxes and Replicas contain them.

- Canonical: https://replicas.dev/resources/claude-code-sandbox

Claude Code, Codex and OpenCode ask before they run a command or edit a file. Claude Code turns those prompts off with `--dangerously-skip-permissions`, Codex with `--yolo` and OpenCode with `--auto`. Without prompts, an agent can work through a long task on its own. Anthropic's help text for the flag says it is "recommended only for sandboxes with no internet access."

When you turn off permission prompts, the agent runs every command without asking. On your laptop, that means a bad command can read your keys or change files outside the project. Claude Code's /sandbox, Codex's sandbox modes and Docker limit some of this, but the agent still runs on your computer. Running each task in its own cloud VM keeps it away from your files and logins. You can build that yourself on a sandbox provider such as E2B, or use a cloud agent platform like Replicas.

What an agent can access with permission prompts off, by setup.

| Setup | Files outside the project | Your keys and logins | The internet | Your computer |
| --- | --- | --- | --- | --- |
| Laptop, prompts skipped (--dangerously-skip-permissions, --yolo, opencode --auto) | Can change | Can read and send | Open | Same machine |
| Claude Code /sandbox (Shell commands only) | Read, no writes | Readable, allowlist to send | Allowlist, starts empty | Same kernel |
| Codex workspace-write (OpenAI's default for local work) | Read, no writes | Readable, no network to send | Off | Same kernel |
| Docker or devcontainer (Repo bind-mounted) | Only what you mount | Only what you pass in | Open unless you add a firewall | Shared kernel |
| Cloud sandbox (E2B, Tensorlake, Modal, Vercel) | None of yours | Only what you pass in | Provider setting | Separate machine |
| Replicas (One cloud VM per task) | None of yours | Agent login, env variables, App token | Open unless you add a firewall | Separate machine |

## What --dangerously-skip-permissions, Codex yolo mode and OpenCode --auto turn off

| Agent | Flag | What it does |
|---|---|---|
| Claude Code | `--dangerously-skip-permissions` | Starts in [`bypassPermissions` mode](https://code.claude.com/docs/en/permission-modes), the same as `--permission-mode bypassPermissions` |
| Codex | `--dangerously-bypass-approvals-and-sandbox`, alias `--yolo` | Turns off approvals and the [sandbox](https://learn.chatgpt.com/docs/agent-approvals-security) (`danger-full-access`) |
| OpenCode | `--auto` | Approves every [permission](https://opencode.ai/docs/permissions/) not explicitly set to `deny` |

With these flags on, the agent runs commands as your user. On a laptop, that means it can read `~/.ssh`, `~/.aws` and any API key in your shell, change files outside the project, push to any repository your git login can reach, and send any of that over the network. Anthropic's docs say `bypassPermissions` "offers no protection against prompt injection or unintended actions."

Prompt injection is the main risk in practice. A README, issue, web page or dependency the agent reads can contain instructions, and the agent may follow them.

Claude Code keeps a few checks in this mode:

- It refuses to start as root or under `sudo` on Linux and macOS.
- It still asks before `rm` on critical paths.
- The first interactive run shows a warning you have to accept.
- Admins can turn the mode off for everyone with [`disableBypassPermissionsMode`](https://code.claude.com/docs/en/settings-reference) in managed settings.

These checks don't stop the agent from reading a secret and sending it to another server.

## Claude Code's /sandbox and Codex's sandbox modes

Claude Code and Codex can both sandbox the commands they run on your machine. They use macOS Seatbelt and Linux bubblewrap to limit which files a command can write and whether it can reach the network, so you approve fewer prompts while you work. Both sandboxes still let commands read your files, so they don't make it safe to skip permissions on a laptop.

| | Claude Code `/sandbox` | Codex `workspace-write` |
|---|---|---|
| On by default | No. Turn it on with `/sandbox` or `sandbox.enabled` | OpenAI's docs call it the default for local work |
| What runs in the sandbox | Bash, PowerShell and Monitor commands | Commands the model runs |
| Writes | Project folder and temp folders | Project folder, `/tmp` and `$TMPDIR`. `.git`, `.codex` and `.agents` stay read-only |
| Reads | Most of the machine, including `~/.ssh` and `~/.aws/credentials` | Not limited. The sandbox restricts writes and network only |
| Network | Through a local proxy, to an allowlist that starts empty | Off unless you set `network_access = true` |
| Running without the sandbox | The agent can retry a blocked command unsandboxed, unless you set `allowUnsandboxedCommands: false` | `danger-full-access` or `--yolo` |
| Linux requirements | `bubblewrap` and `socat` | Bundled bubblewrap, with unprivileged user namespaces |

Claude Code's file tools (Read, Edit, Write), web fetches, hooks and local MCP servers run outside its sandbox. [Anthropic says](https://code.claude.com/docs/en/sandboxing) that "sandboxing reduces risk but is not a complete isolation boundary," and that the sandboxed Bash tool on its own "is not sufficient for fully unattended runs." For a stricter setup, Anthropic's open-source [sandbox runtime](https://github.com/anthropics/sandbox-runtime) wraps the whole `claude` process (`srt claude`). Anthropic describes it as a beta research preview.

This `.claude/settings.json` turns the sandbox on, stops Claude Code from running if the sandbox can't start, blocks the unsandboxed retry, and allows network access only to npm:

```json
{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "network": { "allowedDomains": ["registry.npmjs.org"] }
  }
}
```

## Running Claude Code, Codex and OpenCode in Docker

A container gives the agent its own filesystem, so it can only see the folders you mount and the environment variables you pass in. This Dockerfile installs all three agents and runs them as a non-root user, because Claude Code refuses `--dangerously-skip-permissions` as root:

```dockerfile
FROM node:22
RUN npm install -g @anthropic-ai/claude-code @openai/codex opencode-ai
USER node
WORKDIR /workspace
```

```bash
docker build -t agent-box .
docker run --rm -it -v "$PWD":/workspace -e ANTHROPIC_API_KEY agent-box \
  claude --dangerously-skip-permissions
```

The same image runs Codex with `--yolo` and OpenCode with `--auto`. A container like this has three limits:

- **The mounted project is your real folder.** Bind mounts are [writable by default](https://docs.docker.com/engine/storage/bind-mounts/), so the agent's changes land on your disk immediately. The container's `node` user (uid 1000) also needs write access to the folder.
- **Credentials inside the container are readable.** Anthropic's [devcontainer docs](https://code.claude.com/docs/en/devcontainer) say a container doesn't stop a malicious project "from exfiltrating anything accessible inside the container, including the Claude Code credentials stored in `~/.claude`," and advise against mounting host secrets. The same applies to keys you pass with `-e`.
- **Codex's own sandbox may not start in a container.** [OpenAI's docs](https://learn.chatgpt.com/docs/agent-approvals-security) say it may not work when the container blocks the namespaces it needs, and to let the container provide isolation and run Codex with `--sandbox danger-full-access` inside it.

Plain containers don't restrict the network, and they share the host's kernel. Anthropic's [reference devcontainer](https://github.com/anthropics/claude-code/tree/main/.devcontainer) adds a firewall script that blocks outbound traffic except to GitHub, npm, the Anthropic API and a few other domains.

[Docker Sandboxes](https://docs.docker.com/ai/sandboxes/) is Docker's own product for running agents. `sbx run claude` starts the agent in a microVM with its own kernel, and a proxy on the host adds API keys to requests so the keys never enter the VM. It's free to run locally, supports Claude Code, Codex, OpenCode and more, and runs on macOS with Apple silicon, Windows 11 and Ubuntu 24.04 or later.

Containers and Docker Sandboxes run on your own machine, so the number of tasks you can run at once depends on its CPU and memory, and tasks stop when it sleeps.

## Running agents in a cloud sandbox

Cloud sandbox providers rent you a VM billed by the second. The agent runs on their hardware, so nothing it does can reach your computer.

| Provider | Isolation | List price | Longest session |
|---|---|---|---|
| [E2B](https://e2b.dev/pricing) | Firecracker microVM ([per E2B](https://e2b.dev/blog/firecracker-vs-qemu)) | $0.000014 per vCPU-second and $0.0000045 per GiB-second, about $0.17 an hour for the default 2 vCPU and 4 GiB | 1 hour on Hobby, 24 hours on Pro |
| [Tensorlake](https://www.tensorlake.ai/pricing) | Firecracker microVM | $0.07 per core-hour, $0.015 per GB-hour | 2 hours free, 24 hours on credits |
| [Modal](https://modal.com/docs/guide/sandboxes) | gVisor | 3× Modal's list CPU and memory rates | 24 hours |
| [Vercel Sandbox](https://vercel.com/docs/vercel-sandbox) | Firecracker microVM | $0.128 per active CPU-hour, $0.0212 per GB-hour on Pro | 45 minutes on Hobby, 24 hours on Pro |

A provider gives you a VM and an SDK to control it. To run coding tasks on one, you also need to build these parts yourself.

| Part | What you build |
|---|---|
| Image | The agent CLIs, your language toolchains, and enough memory. Claude Code [needs 4 GB](https://code.claude.com/docs/en/setup) |
| Secrets | A way to get model keys and repository tokens into the VM without putting them in the image or logs |
| Git | Cloning, a git identity, and a token that can push. A [fine-grained token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) can be limited to specific repositories |
| Pull requests | Opening the PR, then sending review comments and CI failures back to the agent |
| Triggers | Starting tasks from Slack, Linear or GitHub, and posting results back |
| Lifecycle | Pausing idle sandboxes, resuming them for follow-up messages, and deleting old ones |

This is worth building if running agents is part of your product. For the simplest version, a rented VM with tmux, our guide to [running Claude Code and Codex off your laptop](/resources/claude-code-in-the-cloud) walks through the setup with timings.

## Running agents in Replicas

[Replicas](https://docs.replicas.dev/features/workspaces/overview) runs each task in its own cloud VM, with your repositories cloned and the agent you choose signed in. Claude Code, Codex, OpenCode and the other supported agents run there with permission prompts off. The VM doesn't have your laptop's files or logins, only the repositories and the variables you add to the environment. You can start a task from the dashboard, Slack, Linear, a GitHub or GitLab comment, the CLI or the API, and the agent opens a pull or merge request when it's done.

| | How it works |
|---|---|
| Isolation | One VM per task, with 2 to 8 vCPUs and 8 to 32 GB of memory depending on [size](https://docs.replicas.dev/admin/billing) |
| Agents | Claude Code, Codex, OpenCode, Cursor, Pi and Muse Code, signed in with your plan or API keys |
| Repository access | By default, a GitHub App token that Replicas refreshes. It reaches every repository the App installation covers, not only the task's, so install the App only on repositories agents should work in. Admins can [block agents](https://docs.replicas.dev/admin/security) from merging PRs or pushing to protected default branches |
| Secrets | Environment variables, files, or a [Doppler or Infisical](https://docs.replicas.dev/features/environments) sync. Values marked sensitive aren't shown again in the app |
| Network | Open by default. You can restrict it with firewall rules in a [start hook](https://docs.replicas.dev/features/workspaces/start-hook-networking) |
| Cost | Billed per minute while the VM is awake: $0.004 for `small` and $0.008 for the default `large`. Workspaces sleep after 30 idle minutes. Model usage is billed to your own plan or API key |

The agent can read the variables and the agent login in its own VM, so give each environment only the secrets its tasks need. You can [try Replicas with $100 of free usage](https://app.replicas.dev), no card required.

## Comparison of the sandbox options

| | Isolation | Setup | Credentials the agent can read | Tasks at once | Cost |
|---|---|---|---|---|---|
| Laptop, prompts skipped | None | None | All of yours | A few, with git worktrees | Model usage only |
| Claude Code `/sandbox`, Codex `workspace-write` | Process sandbox on your kernel | A setting. Linux needs bubblewrap | All of yours. Sandboxed commands can only send to the allowlist, but Claude Code's web fetches and local MCP servers run outside it | A few, with git worktrees | Free |
| Docker or devcontainer | Container on your kernel | A Dockerfile, plus a firewall if you want one | What you mount or pass in | As many as your machine fits | Free |
| Docker Sandboxes (`sbx`) | microVM on your machine | Install `sbx` | None of your API keys, which stay outside the VM | As many as your machine fits | Free locally |
| Cloud sandbox | VM in the cloud | Your own image, secrets, git and PR code | What you pass in | Up to the provider's limit | About $0.17 an hour on E2B's default size |
| Replicas | VM per task in the cloud | Connect a repository and a model login | The environment's variables, the agent login and the GitHub App token | One VM per task | $0.48 an hour on the default size while awake |

## Secrets and network egress

A container or VM limits which of your files and keys the agent can read. Network rules limit which servers it can send them to. An agent in a VM with open network access can still send any key you gave it to another server.

| Practice | Why |
|---|---|
| Give the agent keys scoped to the task, not your own logins | A fine-grained GitHub token limited to one repository, or a separate model key, can be revoked without affecting anything else |
| Don't mount `~/.ssh`, `~/.aws` or `~/.config/gh` | Anthropic's [devcontainer docs](https://code.claude.com/docs/en/devcontainer) recommend "repository-scoped or short-lived tokens" instead |
| Allow only the domains the task needs | Package registries and your git host cover most coding work |
| Be careful with broad domains | Anthropic notes that its sandbox proxy doesn't inspect TLS, so an allowed domain like `github.com` can still be used to send data out |
| Keep secrets out of the agent's session where you can | OpenAI's [Codex cloud docs](https://learn.chatgpt.com/docs/environments/cloud-environment) say secrets "are only available to setup scripts" and are removed before the agent runs. Docker Sandboxes keeps API keys outside the VM |

In all of these setups, anything the agent reads is also sent to the model provider as part of the conversation.

## Codex and OpenCode sandbox settings

**Codex.** The sandbox mode and the approval policy are separate settings, and both can go in `~/.codex/config.toml`:

```toml
sandbox_mode = "workspace-write"
approval_policy = "on-request"

[sandbox_workspace_write]
network_access = false
```

| Flag | What it does |
|---|---|
| `-s read-only`, `workspace-write` or `danger-full-access` | Sets the sandbox mode |
| `-a on-request` or `never` | Sets when Codex asks for approval. Recent versions no longer accept `untrusted` or `on-failure` |
| `--yolo` | Same as `--dangerously-bypass-approvals-and-sandbox`. It isn't listed in `--help`, but it still works |
| `--add-dir <dir>` | Adds a writable folder without turning the sandbox off |

Recent versions also removed `--full-auto`. On Linux, Codex sandboxes commands with bubblewrap and seccomp.

**OpenCode.** OpenCode's docs describe permission rules but no OS sandbox, so run it in a container or VM whenever you use `--auto`. Most permissions default to `allow`. Only `external_directory`, `doom_loop` and reading `.env` files ask by default. You can make it stricter in `opencode.json`:

```json
{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "bash": { "*": "ask", "git *": "allow", "rm *": "deny" },
    "webfetch": "deny"
  }
}
```

`opencode run --auto` approves anything not set to `deny`, and the `OPENCODE_PERMISSION` environment variable accepts the same JSON. OpenCode publishes an official image, which you can run with `docker run -it --rm ghcr.io/anomalyco/opencode`, and Docker Sandboxes supports it too. For how its permissions and pricing compare with Claude Code, see [OpenCode vs Claude Code](/resources/opencode-vs-claude-code) and [OpenCode alternatives](/resources/opencode-alternatives).

## Which option to use

| If you | Use |
|---|---|
| Are watching the session and want fewer prompts | Claude Code's `/sandbox` or Codex's `workspace-write` |
| Want prompts off on your own machine | Docker Sandboxes, or a container with a firewall and no host credentials mounted |
| Are building agents into your own product | A cloud sandbox |
| Want prompts off, several tasks at once, and a PR at the end | [Replicas](https://app.replicas.dev), or another of the [cloud coding agents](/best-cloud-coding-agents) |

## Sources

Flags and behavior on this page come from each vendor's docs as of October 2026:

- Anthropic: [permission modes](https://code.claude.com/docs/en/permission-modes), [sandboxing](https://code.claude.com/docs/en/sandboxing), [devcontainer](https://code.claude.com/docs/en/devcontainer), [settings](https://code.claude.com/docs/en/settings-reference)
- OpenAI: [Codex approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security), [Codex cloud environments](https://learn.chatgpt.com/docs/environments/cloud-environment)
- OpenCode: [permissions](https://opencode.ai/docs/permissions/), [CLI](https://opencode.ai/docs/cli/)
- Docker: [bind mounts](https://docs.docker.com/engine/storage/bind-mounts/), [Docker Sandboxes](https://docs.docker.com/ai/sandboxes/)
- Replicas: [workspaces](https://docs.replicas.dev/features/workspaces/overview), [billing](https://docs.replicas.dev/admin/billing), [security policies](https://docs.replicas.dev/admin/security)


## FAQ

### What does --dangerously-skip-permissions do in Claude Code?
It starts Claude Code in bypassPermissions mode, so commands and file edits run without asking first. Claude Code still refuses to start this way as root, still asks before rm on critical paths, and admins can turn the mode off with disableBypassPermissionsMode. Anthropic recommends it only in isolated containers or VMs.

### Is Claude Code's /sandbox enough to run with permissions skipped?
Not on its own. It sandboxes shell commands only, lets them read most of the machine including ~/.ssh, and leaves file tools, hooks and local MCP servers outside. Anthropic says it is not a complete isolation boundary and is not sufficient for fully unattended runs.

### What is Codex yolo mode?
--yolo is an alias for --dangerously-bypass-approvals-and-sandbox. It turns off approval prompts and the sandbox, so commands run with danger-full-access. OpenAI says it is meant for environments that are already sandboxed, such as a container or VM.

### Does OpenCode have a sandbox?
OpenCode's docs describe permissions in opencode.json but no OS sandbox, and most permissions default to allow. opencode run --auto approves anything not set to deny, so run it in a container or VM when you use it.

### Is running Claude Code in Docker safe?
It is safer than running on your laptop, but the container doesn't isolate everything. The agent can still change the bind-mounted project, read any keys you pass in, and reach the network unless you add a firewall, and containers share your computer's kernel. Docker Sandboxes or a cloud VM give stronger isolation.