Why I Run My AI Coding Assistant in a Docker Container (And Why You Should Too)

Let's talk honestly about AI coding agents for a second. At this point, you've probably fallen into one of two camps. Either you've thrown all caution to the wind and let your agent loose on your system with zero oversight, or you're stuck in approval hell, frantically clicking "Allow" every time the thing wants to run a simple command.

Neither extreme feels great, right?

For the longest time, I was firmly in the approval-clicking camp. Was I being responsible? Absolutely. Was it destroying my focus every few minutes? You bet. Claude Code wanted to run a bash script? Approve. Install a dependency? Approve. Tweak a config file? Here comes another popup. My flow state was getting interrupted constantly, and honestly, it was draining.

On the flip side, I watched colleagues go full chaos mode—no permissions, no guardrails, just pure trust and optimism. That made me nervous too. These tools are genuinely powerful, which means they can also do serious damage if something unexpected happens.

The sweet spot I eventually found? Running the whole thing inside a Docker container.

The Core Concept

Here's the deal: instead of giving the AI assistant direct access to your actual computer, you spin it up inside a container with your project folder mounted in. The agent does its work in that isolated environment, where any destructive actions stay contained within the container's filesystem.

Delete everything by accident? You're wiping the container, not your real machine.

This means you can actually enable YOLO-style features like --dangerously-skip-permissions without the looming fear of watching your entire home directory vanish into the void.

Let me walk you through how this actually works.

Getting Claude Code Running in Docker

The foundation is a simple Dockerfile:

FROM node:20-bookworm-slim

RUN apt-get update && apt-get install -y --no-install-recommends git curl ca-certificates && rm -rf /var/lib/apt/lists/*

RUN curl -fsSL https://claude.ai/install.sh | bash

ENV PATH="/root/.local/bin:${PATH}"

WORKDIR /workspace

ENTRYPOINT ["claude", "--dangerously-skip-permissions"]

Build it once:

docker build -t claude-code .

Then launch it with your current folder mounted in:

docker run -it -v "$PWD:/workspace" claude-code

And just like that, Claude Code is running with access to your project files. The container can read, write, and execute within that workspace, but it's completely separated from your actual system.

Handling Authentication

This is where things get a bit tricky. On Mac, Claude Code tucks its credentials into Keychain. Linux containers don't play nice with Keychain though. So you need a different approach.

The fix is passing an API token through an environment variable. First, grab your setup token:

claude setup-token

Then create a tiny startup script that pulls this token and sets up the container's credentials:

#!/bin/bash
echo "${ANTHROPIC_TOKEN}" > /root/.claude/credentials.json
exec claude --dangerously-skip-permissions

Now when launching the container, just pass the token along:

docker run -it -v "$PWD:/workspace" -e ANTHROPIC_TOKEN="$(claude setup-token)" claude-code

Making It Actually Usable

Let's be real—you don't want to remember all those flags every single time. Drop this in your shell config:

cc() {
    docker run -it \
        -v "$PWD:/workspace" \
        -v "$HOME/.claude:/root/.claude" \
        -v "$HOME/.claude/skills:/root/.claude/skills" \
        -v "$HOME/.claude/settings.json:/root/.claude/settings.json:ro" \
        -e ANTHROPIC_TOKEN="$(claude setup-token 2>/dev/null)" \
        --env-file ~/.claude/env \
        claude-code "$@"
}

What this does:

• Mounts wherever you are as /workspace
• Carries over your Claude configuration and custom skills
• Loads environment variables (handy if the agent needs API keys)
• Lets you type cc from any directory and instantly get a fully configured coding assistant

Where Containerization Falls Short

I want to be transparent about the actual threat model here. Containerization shields your host machine from the agent's direct actions. It does NOT protect you from:

• Prompt injection attacks: If someone can control what the agent sees, they might trick it into stealing your code or secrets
• Leaked API keys: The agent can still access any keys sitting in your workspace or environment
• Network-based threats: The container still has internet access
• Compromised dependencies: Malicious packages the agent installs inside the container are still malicious

What you DO get protection from is the "oops, the agent wiped my entire home directory" scenario or "it ran rm -rf / and now I'm reinstalling everything." For me, that's been worth the initial setup many times over.

Is This Overengineering?

Here's my honest take: it depends entirely on the situation. For quick one-off scripts and throwaway tasks, I still just use Claude Code normally with the standard permission prompts. But for actual feature development, significant refactoring, or working in repositories I can't afford to break? The container approach has saved me hours of mindless approve-clicking and given me real peace of mind.

The beautiful part is that once you grasp the concept, you can adapt it. Different AI coding tools have different quirks—credential storage locations, config file formats, entrypoint requirements—but the underlying principle holds: isolate the agent, give it controlled access to your work, and let it do its thing without hovering nervously over its shoulder.

The Bottom Line

We're at an interesting crossroads with AI coding tools. The safety defaults exist for good reasons—these agents are powerful and autonomous. But conservative defaults often mean "built for people trying things out" rather than "built for serious daily work."

Containerization is one way to bridge that gap. It's not bulletproof security, but it's practical protection that lets you actually capture the productivity gains these tools offer without constantly playing permission whack-a-mole.

Give it a try. Once you've got the alias set up and you're typing cc to launch a fully loaded coding assistant in seconds, you won't look back.

How are you running your AI coding agents these days? Still clicking approve? Full YOLO mode? Got a container trick I didn't cover? I'd love to hear how others are navigating this balance.