fastbytes

Claude Safe — DevOps skill for Claude Code

DevOps community

Sandboxed Claude Code launcher — runs Claude in Docker with tmux session management and git worktree isolation.

How to install Claude Safe

This entry records only its repository, not the path inside it, so there is no exact command to give. Open fastbytes/claude-safe and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Claude Safe does

Sandboxed Claude Code launcher — runs Claude in Docker with tmux session management and git worktree isolation.

Alternatives in DevOps

Render Deploy — Deploy applications to Render's cloud platform using Git-backed services 14.6k ★
Ship Release — Systematic release workflow for RTK: build verification, version bump, changelog update, git tag, and push to 11.9k ★
WP CLI And Ops — WordPress CLI and operations management 902 ★

README

claude-safe

Sandboxed Claude Code launcher. Runs Claude Code inside Docker containers with tmux session management and git worktree isolation.

Architecture

host shell
  └─ claude-safe
       └─ docker run -d (container: sleep infinity)
            └─ tmux
                 ├─ window 1: claude    ← main session
                 ├─ window 2: bash      ← user splits
                 └─ window 3: claude    ← user spawns another

tmux runs **inside** the container. Every pane and window is sandboxed. `Ctrl-b d` detaches back to the host — the container keeps running. `claude-safe` reattaches.

Why

Claude Code has unrestricted shell access. Running it on a bare host means it can `rm -rf`, read secrets, install packages globally, or modify system configs. claude-safe puts it in a container with explicit mount controls:

Workspace: read-write (your project only)
~/.claude: granular ro/rw (settings ro, session state rw)
~/.kube, ~/.ssh, ~/.gitconfig: read-only
~/Code: read-only cross-project reference
Everything else: not mounted

Requirements

Docker (OrbStack recommended on macOS, Docker Engine on Linux)
Git
Bash 4+
jq

tmux is included in the container image — not needed on the host.

Install

./claude-safe install

The installer detects your environment, prompts for each option with sensible defaults, writes `~/.config/claude-safe/config.sh`, installs the script, and builds the Docker image. Run `claude-safe install` again anytime to reconfigure.

Manual install

# 1. Build the image
docker build -t claude-safe -f Dockerfile.claude-safe .

# 2. Install the script
cp claude-safe ~/.local/bin/claude-safe
chmod +x ~/.local/bin/claude-safe

# 3. Copy config
mkdir -p ~/.config/claude-safe
cp config.example.sh ~/.config/claude-safe/config.sh
# Edit to match your setup

# 4. (Optional) tmux config for remote access
cp tmux.conf ~/.config/claude-safe/tmux.conf

# 5. Ve