stefanoginella

Aicontainer — Development skill for Claude Code

Development community

Sandboxed devcontainer for running Claude Code, Codex, and OpenCode in bypass / auto-approve mode.

How to install Aicontainer

This entry records only its repository, not the path inside it, so there is no exact command to give. Open stefanoginella/aicontainer and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Aicontainer does

Sandboxed devcontainer for running Claude Code, Codex, and OpenCode in bypass / auto-approve mode.

Alternatives in Development

Bypass 403 — Probe a 403/401 endpoint with the most-paid bypass tricks (header injection, path encoding, method swap, WAF f 4.5k ★
Discipline — Toggle discipline mode — auto-invoke verification, brainstorming-before-coding, and review checks 2.8k ★
12 Yolo Auto Mode Classifier — YOLO/Auto-Mode Classifier System 2.3k ★

README

aicontainer

[![npm version](https://img.shields.io/npm/v/aicontainer?logo=npm)](https://www.npmjs.com/package/aicontainer) [![release](https://github.com/stefanoginella/aicontainer/actions/workflows/release.yml/badge.svg)](https://github.com/stefanoginella/aicontainer/actions/workflows/release.yml) [![rebuild](https://github.com/stefanoginella/aicontainer/actions/workflows/rebuild.yml/badge.svg)](https://github.com/stefanoginella/aicontainer/actions/workflows/rebuild.yml) [![License: MIT](https://img.shields.io/npm/l/aicontainer?color=yellow)](LICENSE) [![Container: GHCR](https://img.shields.io/badge/container-ghcr.io-2188ff?logo=github)](https://github.com/stefanoginella/aicontainer/pkgs/container/aicontainer) [![Devcontainer spec](https://img.shields.io/badge/devcontainer-spec-blue?logo=visualstudiocode)](https://containers.dev/)

A sandboxed devcontainer for running [Claude Code](https://claude.ai/code), [Codex](https://github.com/openai/codex), and [OpenCode](https://opencode.ai) in bypass / auto-approve mode safely across multiple projects.

**Why?** Auto-approve is the only way these CLIs actually fly — but pointed at your real `$HOME` it also lets a prompt-injected dependency read `.env`, exfiltrate shell history, or push through your `gh` token. `aicontainer` puts the AI behind a devcontainer boundary so you can keep auto-approve on without rebuilding your machine each time.

**What you get:** filesystem isolation, **no Docker object access by default** through a digest-pinned [socket proxy](https://github.com/Tecnativa/docker-socket-proxy), a minimal shared tool hook, an always-on cloud-metadata/link-local block, and an **opt-in** outbound allowlist. Host preferences are reduced to fixed safe fields before the agent sees them; logins still carry across projects. Defaults are listed in [What's in the box](#whats-in-the-box) so you know exactly what you're adopting.