fabiocicerchia

Azkaban — AI skill for Claude Code

AI community

A jail for AI CLIs.

How to install Azkaban

This entry records only its repository, not the path inside it, so there is no exact command to give. Open fabiocicerchia/azkaban and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Azkaban does

A jail for AI CLIs. azkaban confines a coding agent (Claude Code, aider, etc.) to a single project directory using bubblewrap and Landlock, so a misbehaving or hallucinating tool cannot read your ~/.ssh, exfiltrate credentials, or rm -rf your home.

Alternatives in AI

HolyClaude — AI coding workstation: Claude Code + web UI + 7 AI CLIs + headless browser + 50+ tools 2k ★
Botmux — Bridge Feishu/Lark to AI coding CLIs — Claude Code, Codex, Gemini, OpenCode… every DM, group or topic spawns i 1.2k ★
CliRelay — Self-hosted AI gateway for coding CLIs — one OpenAI/Claude/Gemini/Codex-compatible endpoint, with a multi-tena 1k ★

README

🏰 azkaban

[![CI](https://github.com/fabiocicerchia/azkaban/actions/workflows/code-quality.yml/badge.svg)](https://github.com/fabiocicerchia/azkaban/actions/workflows/code-quality.yml) [![Security](https://github.com/fabiocicerchia/azkaban/actions/workflows/security.yml/badge.svg)](https://github.com/fabiocicerchia/azkaban/actions/workflows/security.yml) [![License](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE) [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/fabiocicerchia/azkaban/badge)](https://securityscorecards.dev/viewer/?uri=github.com/fabiocicerchia/azkaban) [![CI carbon](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/fabiocicerchia/azkaban/gh-pages/badge.json)](.github/workflows/carbon-badge.yml)

**A jail for AI CLIs.** `azkaban` confines a coding agent (Claude Code, aider, etc.) to a single project directory using [bubblewrap](https://github.com/containers/bubblewrap) and [Landlock](https://docs.kernel.org/userspace-api/landlock.html), so a misbehaving or hallucinating tool cannot read your `~/.ssh`, exfiltrate credentials, or `rm -rf` your home.

The primary threat is **accidental destruction** — an agent that misreads a path and deletes the wrong folder — not a determined attacker. Network isolation is secondary and off by default; an AI CLI that cannot reach the internet is not much use. Everything here is arranged around that priority.

It is small and auditable: the whole security model fits in two files (`main.go`, `dockerproxy.go`) you can read in one sitting.

**Linux only, and it is a fence, not a vault.** The default posture is arranged against a confused tool, not a hostile one: the network is shared, the terminal is shared, and the `KNOWN ESCAPE VECTORS` block at the bottom of `main.go` lists what is deliberately left open. Without bubblewrap ≥ 0.9 and kernel ≥ 5.11 the write-discarding overlay is unavailable and writes are real — azkaban warns, and the w