ContAIned

cont[AI]ned

[✦] take back control of your coding agent!

A coding agent CLI built on [Claude Code](https://docs.anthropic.com/en/docs/claude-code/overview).

The agent operates within a defined workspace inside an isolated Docker container. All tool calls are audited. Policy is baked into the container image at build time and enforced by hook scripts before every tool call — the agent cannot change the rules it operates under. High-risk actions (such as git mutations) can be configured to escalate to the operator for explicit approval rather than being allowed or blocked outright.

Contents

• Why contAIned?
• Install
• Quickstart
• Commands
  • `contAIned`
  • `contAIned init`
  • `contAIned verify`
• Task lifecycle
• How it works
  • Isolation
  • Governance
  • Cedar-inspired policy rules
  • Defense-in-depth with Claude Code's sandbox
  • Egress filtering
  • Tracer
• Customizing policy
• Image support
• Known gaps
  • QA hook coverage
  • Garbage collection
  • Narrative injection budget
  • Egress filtering against a malicious agent
• Security model

Why contAIned?

Three existing primitives handle adjacent problems but leave a critical gap:

Claude Code's `/sandbox`

Claude Code ships a built-i