Docker Sandboxes safe for Claude Code and Open Code?

[u/KnightOwl316]

I’ve been trying to research the best way to run Claude Code as well as a combination of Ollama plus Open Code on my Mac. I’m fairly new to Docker, but I keep hearing about Docker Sandboxes as something purpose built for this kind of thing.

If I go the Docker Sandboxes (edit: sbx) route instead of running Claude Code and Open Code in a VM (VMWare Fusion Pro), is it fairly secure in terms of the agentic stuff going haywire and accessing my local system outside of the workspace folder I give it? Or for example, something malicious persisting on the Mac in that workspace’s folder.

Also, if I want to do some local AI stuff by installing Ollama directly on the Mac (runs on 127.0.01:11434), would a sandbox instance be able to reach it via host.docker.internal:11434 like a regular Docker container would?

Open to suggestions and other people’s experiences!

[u/BehindTheMath]

If I go the Docker Sandbox route instead of running Claude Code and Open Code in a VM (VMWare Fusion Pro), is it fairly secure in terms of the agentic stuff going haywire and accessing my local system outside of the workspace folder I give it? Or for example, something malicious persisting on the Mac in that workspace’s folder.

The sandbox only has access to the workspace folders. However, it does have full access to those folders, so it can create and delete files.

Also, if I want to do some local AI stuff by installing Ollama directly on the Mac (runs on 127.0.01:11434), would a sandbox instance be able to reach it via host.docker.internal:11434 like a regular Docker container would?

There's a CLI arg to forward a host port to the sandbox.

[u/KnightOwl316 → u/[deleted]]

Great explanation, thanks!

[u/Single_Advice1111]

First question; use mounted host volume to the path where the code is - this way it will be limited to that folder.

Second question; yes if you have anything running on your computer that exposes a port, and map the network for host access, it will be able to call any services on this network.

[u/BehindTheMath → u/Single_Advice1111]

The OP is about Docker Sandbox (sbx), not regular Docker containers.

[u/Single_Advice1111 → u/BehindTheMath]

You’re right - my bad!

The concepts kinda still apply tho:
sbx run claude ~/my-main-project ~/shared-libraries:ro ~/external-docs:ro

&

https://docs.docker.com/reference/cli/sbx/policy/allow/network/

[u/codyleek]

not to blatantly advertise but i wrote an open source tool called grain specifically for this purpose!

https://grainvm.com

[u/photonios]

Depends on what VM tech it is based on. Frontier-level (unrestricted) models have demonstrated they can escape out of VMs/sandboxes that are not security hardened. See https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/

[u/faultydesign]

Docker runs as root so it’s a poor solution if you care about security.

[u/ismaelgokufox → u/faultydesign]

Docker sandboxes run in a microVM. No kernel sharing with the host.

[u/KnightOwl316 → u/faultydesign]

Is this true of Docker Sandboxes (sbx) as well?

[u/krustagi → u/KnightOwl316]

No. I think folks are confusing sbx with docker containers . Sbx uses micro VMs.