jay-tank

Boxescape — DevOps skill for Claude Code

DevOps community

How to install Boxescape

This entry records only its repository, not the path inside it, so there is no exact command to give. Open jay-tank/boxescape and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Boxescape does

🧩 VS Code extension: Finds the settings that hand your host to an AI coding agent running "safely" in a dev container or Docker sandbox: --privileged, a mounted docker.sock, host network or PID, CAP_SYS_ADMIN, seccomp=unconfined, ~/.ssh, ~/.aws or $HOME mounted in, forwarded SSH agents, a firewall script that never runs

Alternatives in DevOps

Open Agent Email — Open-source email infrastructure for AI agents: secure inboxes, REST and MCP APIs, SMTP, human approval workfl 2.1k ★
Claude Codex Settings — by fatih akyon - A well-organized, well-written set of plugins covering core developer activities, such as wor 510 ★
Claude Code Sandbox — Run Claude Code safely in local Docker containers without having to approve every permission 301 ★

README

BoxEscape: Dev Container and Agent Sandbox Escape Checker

You put the coding agent in a dev container so it can run with fewer prompts, maybe with `--dangerously-skip-permissions`. It is in a box, so it is safe. Then you look at what the box was built with:

{
  "name": "claude",
  "features": {
    "ghcr.io/anthropics/devcontainer-features/claude-code:1.0": {},
    "ghcr.io/devcontainers/features/docker-outside-of-docker:1": {}   // the host's docker.sock
  },
  "privileged": true,                                                   // "needed for docker"
  "runArgs": ["--network=host"],                                        // "needed for the dev server"
  "mounts": [
    "source=${localEnv:HOME}/.aws,target=/home/node/.aws,type=bind",    // "needed for the deploy script"
    "source=${localEnv:HOME}/.ssh,target=/home/node/.ssh,type=bind"     // "needed for git"
  ],
  "postStartCommand": "sudo /usr/local/bin/init-firewall.sh || true"   // and if it fails, nobody knows
}

Each line was added for a good reason, and together they hand the agent your host: a mounted Docker socket is root on the machine, `privileged` turns off every kernel protection, and your cloud and SSH keys are one prompt injection away from being sent somewhere.

BoxEscape reads your `devcontainer.json`, your Docker Compose services and the `docker run` lines in scripts that start an agent CLI, and shows every setting that lets the container reach the host. When the container runs an AI agent (Claude Code, Codex, Aider, OpenCode, OpenHands, Cline, Cursor Agent, Gemini CLI), the findings that expose secrets or the host are errors.

What you see

Problems and squiggles on the exact setting, with a message that says what it gives the container, and why the container counts as an agent container (It runs an AI agent (feature claude-code) ...).
Quick Fixes (lightbulb): remove privileged, remove a dangerous capAdd / cap_add entry or --cap-add argument, rem