TL;DR - Running Claude Code's permission-skipping mode directly on your host machine exposes local SSH keys, API credentials, and repository files to prompt injection risks. Now, with Claude's Auto mode by default, the safest approach is running the agent inside an isolated, hardened Docker container equipped with an egress firewall.
You gave an AI agent a shell. On your laptop. Next to your SSH keys, your secret cloud credentials, your npm and GitHub tokens, and every API key in your environment. Let's talk about that.
If you run Claude Code long enough, the same thing happens to everyone. In your first session you read every permission prompt like it's a legal contract. By the tenth you're reading most of them. By the hundredth your finger is hovering over "allow" before the prompt even renders.
This is Allow Fatigue, and the community's answer to it has been remarkably consistent. Stop clicking, instead, run claude --dangerously-skip-permissions and let the agent cook. YOLO mode. The flag literally says dangerously, and people run it anyway, because an agent that stops every forty seconds to ask permission isn't an agent. It's a very expensive confirmation dialog.
Anthropic has now built the softer version of that impulse into the product. On August 14, 2026, auto mode becomes the default for Pro, Max, and Team plans: instead of prompting on every action, a classifier waves through whatever it judges safe and only stops for the irreversible, destructive, or out-of-environment ones. It's a real improvement over the reflexive clicker, in Anthropic's own testing it caught 89% of dangerous commands versus 13.6% for humans, but read that number the other way. It still misses roughly one in nine, and a prompt injection only has to slip past once. A classifier is a judgment call on each action, not a wall around any of them.
And whichever you rely on, the skip-permissions flag or the new default, most people are running it right on their host. Bare metal, full home directory, SSH keys, cloud credentials, browser sessions, every other repo you own. One prompt injection from a malicious README, one poisoned build script, and the agent can reach all of it.
There is a well-known fix, and it's the one Anthropic itself recommends. If you're going to skip permissions, run Claude Code inside a container. The container becomes the permission system, a sandbox for the AI coding agent. The agent can do whatever it wants inside a box that holds no SSH keys, no cloud credentials, no browser data, and no access to your other repos. A hijacked session reaches exactly what you mounted and nothing else.
This is the right architecture, and we're not here to replace it, we're here to make it better. Because the containers people actually reach for have a problem of their own: they're flooded with vulnerabilities. Whatever boundary you pick, something has to run inside it, and that something is a container image, the one thing nobody thinks to check. So what's in the box?
The official Claude Code container is the reference devcontainer, a Dockerfile plus init-firewall.sh in the anthropics/claude-code repo that you build yourself. It's not even a prebuilt registry image, and it expects a devcontainer-aware editor to assemble and run it.
It builds on node:20. That's full Debian bookworm, carrying a Node.js runtime that reached end-of-life on April 30, 2026. We built it locally, exactly as shipped at v2.1.226, and scanned it with grype for vulnerabilities the same day as our own image, on the same machine:
That's 99% fewer vulnerabilities, with zero critical CVEs. The image is smaller too, 1.91 GB vs 2.39 GB.
And the 16 that remain aren't packages we chose to ship vulnerable, they're the CVEs that have no upstream fix yet as of today. There is nothing to update to.
The moment upstream releases a fix, the image is rebuilt and the CVE drops off. Compare that to the official container, where 1,804 of the 3,068 findings do sit in that same no-fix-yet bucket on top of more than a thousand that are simply outdated packages.
Docker ships a Claude Code image too, as part of its Sandboxes product. Let's see what their image (docker/sandbox-templates:claude-code) contains vs official Anthropic vs Minimus:
Every cell comes from the same machine and the same scanner (grype 0.116.1), reproducible with a single grype <image>.
Official reference devcontainer (built from anthropics/claude-code v2.1.226)
Scan Results:
├── 3,068 TOTAL vulnerabilities ❌❌❌
├── 107 CRITICAL ❌
├── 681 HIGH ❌
├── 1,015 MEDIUM ❌
├── 1,265 LOW / NEGLIGIBLE / UNKNOWN
└── 459 OS packages to track ❌
Base OS: Debian 12 (bookworm), Node.js 20 (EOL 2026-04-30)
Image Size: 2.39 GB
Fix Status: 1,804 of 3,068 have no upstream fix available
Security Posture: POOR
Recommendation: Do not rely on this as a security boundary
Representative criticals, none with a fix available:
├── CVE-2026-13221, CVE-2026-57433 - perl (5 criticals, across 4 packages)
├── CVE-2026-11856, CVE-2026-8924 - curl / libcurl (4 criticals, across 4 packages)
└── CVE-2023-5841 - OpenEXR heap overflow (open since 2023)
Scan Results:
├── 16 TOTAL vulnerabilities ✅
├── 0 CRITICAL ✅
├── 3 HIGH ⚠️
├── 11 MEDIUM ⚠️
├── 2 LOW ✅
└── 169 OS packages to track ✅
Base OS: MinimOS (distroless), Node.js 26
Image Size: 1.91 GB
Fix Status: 4 of 16 have no upstream fix available
Security Posture: EXCELLENT
Recommendation: Production-ready
# prefer podman? swap it with docker, same flags
docker run -it --rm \
--cap-add NET_ADMIN --cap-add NET_RAW \
-e CLAUDE_CODE_FIREWALL=true \
-v "$PWD":/workspace \
-v claude-code-config:/home/node/.claude \
-v claude-code-bashhistory:/commandhistory \
-v "$HOME/.gitconfig":/home/node/.gitconfig:ro \
reg.mini.dev/claude-code:latest --dangerously-skip-permissionsThat one command is the full recommendation, and yes, the dangerous flag is right there in it, on purpose. The agent runs non-root in a box that only sees your current directory. The egress firewall default-denies everything except Anthropic, GitHub, npm, Sentry, and the VS Code endpoints, and it is fail-closed, so if it can't come up the container refuses to start. Your login persists in a named volume, so you authenticate once. The read-only .gitconfig is what keeps commits authored by you instead of node@a1b2c3. Inside that box, skipping permissions is a calculated decision instead of a leap of faith.
Nobody types eight lines twice, so put it in your shell rc and let "$@" carry whatever flags you want through to claude:
claude-box() {
docker run -it --rm \
--cap-add NET_ADMIN --cap-add NET_RAW \
-e CLAUDE_CODE_FIREWALL=true \
-v "$PWD":/workspace \
-v claude-code-config:/home/node/.claude \
-v claude-code-bashhistory:/commandhistory \
-v "$HOME/.gitconfig":/home/node/.gitconfig:ro \
reg.mini.dev/claude-code:latest "$@"
}Then it's claude-box --dangerously-skip-permissions from any repo, or claude-box --resume to pick a conversation back up.
The temptation worth naming is the one that shows up the first time the agent can't push: bolting on -v ~/.ssh:/home/node/.ssh. That hands an agent running with permissions skipped the key to every repo you own, and it dissolves the boundary you built the container for. Use a scoped -e GH_TOKEN instead. The firewall already allowlists GitHub. Same reasoning for ~/.aws, ~/.kube and other secrets.
claude --dangerously-skip-permissions?Not on your host. The safe way to use Claude Code's YOLO mode is inside a sandboxed container with an egress firewall, so a compromised session can only reach the project directory you mounted. That is exactly what this Minimus image is built for.
By the scans above, the Minimus Claude Code image, with 16 CVEs by grype and 27 by Docker Scout, zero critical on either scanner, versus 3,068 for the official container.
Yes. Same toolchain (git, gh, zsh, fzf, node, npm, yarn, the node-gyp build chain), same non-root node user, same volume layout, and the same Claude Code release, the CLI entrypoint is byte-identical by SHA-256 to the official reference build at v2.1.226, with plain docker run instead of a devcontainer-aware editor.
docker pull reg.mini.dev/claude-code:latest
The full configuration options detailed in here:
https://images.minimus.io/images/claude-code
Same tools. Same behavior, byte-for-byte. A drop-in replacement for the official devcontainer. A firewall that actually starts. 0 critical CVEs instead of 107.
If you're still running YOLO mode on your host, a container is the fix, and it's a genuinely good one. We just built the version of that container you can actually trust. Don't pour a solid security boundary out of an EOL base image with three thousand known vulnerabilities.
And this isn't a one-off. Claude Code joins 1,000+ hardened images in the Minimus catalog, available in a FREE Community Edition all built the same way. Minimal packages, current versions, near-zero CVEs.
.svg)
.svg)
.svg)
.svg)
