Aidc

aidc

A disposable, isolated dev container for running Claude Code in `--dangerously-skip-permissions` ("yolo") mode. Claude can do whatever it wants in here. The host can't be reached.

What's enforced

• Git is local-only. No SSH keys. No GitHub tokens. No gh CLI. Pre-push hook hard-fails any push attempt. The container has full local git — branches, commits, rebases, stashes — but nothing leaves.
• Network egress is filtered. Squid forward proxy with a blocklist (URLhaus + ThreatFox + HaGeZi-TIF, refreshed every 6h) and a state-actor TLD policy. Quad9 as DNS upstream. Yolo Claude cannot curl evil.sh | bash.
• Docker is isolated. DinD inside the sandbox. The host Docker daemon is unreachable. Claude can build and run images; they live and die with the session.
• Compromise is detected and recovered. A policy sidecar tails the proxy log. A malware-list hit writes a taint flag, optionally pauses the container. Recovery is aidc kill + aidc create, not "clean up."
• Everything is audited. Squid access log, shell history, Claude session transcript, policy events — all preserved on host after aidc kill.

What's bridged from your host

• Claude Code auth (extracted from macOS Keychain at create time; or read directly on Linux/WSL2).
• Claude Code state (~/.claude.json) — onboarding marker, output style, theme, account.
• Per-project memory (~/.claude/projects//) — your conversations follow the repo.
• settings.json — env vars, status line, editor mode.

So inside the container you're still you. Just sandboxed.

Install

One command (Linux and macOS). Installs the latest release after verifying its sha256 against the checksum published in the [Homebrew tap](https://github.com/pacepace/homebrew-aidc):

curl -fsSL https://github.com/pacepace/aidc/releases/latest/download/install.sh | bash

Pin a version with `... | bash -s -- --version v1.0.0`; `--list` shows what's installable. Prefer not to pipe to bash?