Claude Safe

claude-safe

Sandboxed Claude Code launcher. Runs Claude Code inside Docker containers with tmux session management and git worktree isolation.

Architecture

host shell
  └─ claude-safe
       └─ docker run -d (container: sleep infinity)
            └─ tmux
                 ├─ window 1: claude    ← main session
                 ├─ window 2: bash      ← user splits
                 └─ window 3: claude    ← user spawns another

tmux runs **inside** the container. Every pane and window is sandboxed. `Ctrl-b d` detaches back to the host — the container keeps running. `claude-safe` reattaches.

Why

Claude Code has unrestricted shell access. Running it on a bare host means it can `rm -rf`, read secrets, install packages globally, or modify system configs. claude-safe puts it in a container with explicit mount controls:

• Workspace: read-write (your project only)
• ~/.claude: granular ro/rw (settings ro, session state rw)
• ~/.kube, ~/.ssh, ~/.gitconfig: read-only
• ~/Code: read-only cross-project reference
• Everything else: not mounted

Requirements

• Docker (OrbStack recommended on macOS, Docker Engine on Linux)
• Git
• Bash 4+
• jq

tmux is included in the container image — not needed on the host.

Install

./claude-safe install

The installer detects your environment, prompts for each option with sensible defaults, writes `~/.config/claude-safe/config.sh`, installs the script, and builds the Docker image. Run `claude-safe install` again anytime to reconfigure.

Manual install

# 1. Build the image
docker build -t claude-safe -f Dockerfile.claude-safe .

# 2. Install the script
cp claude-safe ~/.local/bin/claude-safe
chmod +x ~/.local/bin/claude-safe

# 3. Copy config
mkdir -p ~/.config/claude-safe
cp config.example.sh ~/.config/claude-safe/config.sh
# Edit to match your setup

# 4. (Optional) tmux config for remote access
cp tmux.conf ~/.config/claude-safe/tmux.conf

# 5. Ve