Cli Sandbox

cli-sandbox

Run `claude`, `codex`, or `pi` in a docker container.

The image defaults to the managed Task Agent egress profile. That profile allows one operator-configured model gateway IPv4/TCP tuple, blocks runtime DNS, and drops all IPv6 traffic. Broader direct-provider access is available only through an explicit interactive profile that is not a confidentiality boundary.

Requirements

• docker
  • With Docker's default capability set, pass --cap-add=NET_ADMIN --cap-add=NET_RAW so the image can configure the firewall.
  • If you also use --cap-drop=ALL, add back exactly NET_ADMIN, NET_RAW, SETGID, and SETUID. The container starts as node; the latter two are required only for the constrained sudo transition that runs firewall bootstrap. The sudo rule is revoked before the requested CLI starts, and the CLI remains an unprivileged process with no effective, permitted, or ambient capabilities.
• Managed runs must provide TASK_AGENT_MODEL_BASE_URL with the literal IPv4 address provisioned for the project's model-gateway Private Service Connect endpoint.
• You will need to mount the codebase you want to work on inside the container
• To persist your auth and settings for gemini and claude, you'll want to mount those directories into /home/node (see usage below)

Usage

CODE_CLI=claude
cd /path/to/codebase
docker run \
  -v $HOME/.$CODE_CLI:/home/node/.$CODE_CLI \
  --cap-add=NET_ADMIN --cap-add=NET_RAW \
  -e CLI_SANDBOX_EGRESS_PROFILE=interactive \
  -v ./:/workspace \
  -w /workspace \
  --rm -it \
  ghcr.io/libops/cli-sandbox:main \
  "$CODE_CLI"
# chit chat

Task Agent model gateway

`managed` is the default profile. It requires `TASK_AGENT_MODEL_BASE_URL` and accepts only a literal IPv4 authority, matching the per-project Private Service Connect address provisioned by the LibOps platform:

docker run \
  --cap-drop=ALL \
  --cap-add=NET_ADMIN \
  --cap-add=NET_RAW \
  --cap-add=