Infrastructure Sandbox Kit

infrastructure-sandbox-kit

A [Docker Sandboxes](https://docs.docker.com/ai/sandboxes/) template and kit that sets up a Claude Code sandbox for Infrastructure-as-Code work. It installs Pulumi, Terraform, OpenTofu and the AWS, Azure and Google Cloud CLIs, and wires [`dirien/my-claude-apm-setup`](https://github.com/dirien/my-claude-apm-setup) (APM) into the agent home so it is active in every workspace.

The sandbox comes with:

• Pulumi CLI, Terraform, and OpenTofu, each pinned to a version and verified by checksum or signature. Pulumi ships with its bundled language plugins, and ESC is available through pulumi env (the standalone esc CLI was retired in 2026).
• kubectl and Helm, pinned and checksum-verified the same way, for the Kubernetes side of IaC work.
• The AWS CLI v2, Azure CLI and gcloud. Set INSTALL_CLOUDS=0 to skip them.
• The language runtimes from the base image (Go, Node, Python, Java) plus the language servers gopls, typescript-language-server, pyright and golangci-lint. Enabling .NET adds csharp-ls and the .NET SDK.
• The Pulumi Cloud token, injected by the sandbox credential proxy. The container only ever sees PULUMI_ACCESS_TOKEN=proxy-managed.
• The pulumi MCP server at user scope (registry lookups, schema and code validation, Neo).
• The APM setup in ~/.claude for every workspace: 34 skills (including the official Pulumi skills, terraform-skill with its code-intelligence companion, and shellcheck-configuration), 3 subagents, the instruction rules, and two guardrail hooks. One blocks destructive shell commands; the other scans edits for secrets and formats them.

Three ways to use it