Security

Background

In February 2025, LayerX Security Research disclosed a critical zero-click remote code execution vulnerability in Anthropic’s Claude Desktop Extensions (DXT) framework. Extensions run unsandboxed with full system privileges, acting as execution bridges between the language model and the local operating system.

Many corporate security teams now require that AI coding tools run only inside dedicated virtual machines, containers, or disposable environments — not directly on corporate endpoints.

This devcontainer satisfies that requirement.

Isolation Model

+------------------------------------------------+
|  Host Machine (corporate endpoint)             |
|                                                |
|  - No AI tool binaries installed               |
|  - No AI tool extensions or plugins            |
|  - Only Docker is required                     |
|                                                |
|  +------------------------------------------+  |
|  |  Docker Container (isolated)             |  |
|  |                                          |  |
|  |  AI tools run here:                      |  |
|  |  - Claude Code CLI                       |  |
|  |  - OpenCode                              |  |
|  |  - Codex                                 |  |
|  |                                          |  |
|  |  No access to:                           |  |
|  |  x Host filesystem                       |  |
|  |  x Host keychain / credential store      |  |
|  |  x Host clipboard                        |  |
|  |  x Host network interfaces               |  |
|  |  x Other host applications               |  |
|  +------------------------------------------+  |
+------------------------------------------------+

Security Controls

No Host Volume Mounts

All data lives in Docker named volumes — not bind-mounted host directories. A compromise inside the container cannot access files on your host machine. See Configuration — Data Persistence for volume details.

No Shared Credential Stores

The container has no access to macOS Keychain, Windows Credential Manager, browser profiles, or the host SSH agent. SSH keys are injected at startup via a base64-encoded environment variable and exist only inside the container.

No Clipboard Sync

Docker containers do not share clipboard state with the host. Data cannot leak through copy/paste.

Network Isolation

The container communicates with the outside world in one of two supported authentication modes:

LiteLLM proxy mode — outbound HTTPS to your LiteLLM proxy through Docker’s NAT.
OAuth mode — outbound HTTPS directly to Anthropic through Docker’s NAT.

The container has no access to VPN tunnels, corporate network interfaces, or other services on the host.

Ephemeral by Design

The entire environment can be destroyed and recreated in seconds. Treat the container as disposable.

Docker
Podman

docker compose down -v
docker compose pull && docker compose up -d

podman-compose down -v
podman-compose pull && podman-compose up -d

CLI-Only Tools

This environment runs AI tools as command-line interfaces only. No desktop applications, no browser extensions, no DXT frameworks. The vulnerability that prompted this isolation model does not apply to CLI usage inside a container.

Container Hardening

The docker-compose.yml applies several defense-in-depth measures:

Capability dropping — All Linux capabilities are dropped (cap_drop: ALL), then only the minimum set is re-added: CHOWN, DAC_OVERRIDE, FOWNER (for volume permission fixes in the entrypoint), SETUID/SETGID (for sudo), NET_RAW (for ping/tcpdump), and NET_ADMIN (for packet capture tools like Wireshark and bettercap).
Resource limits — CPU (4 cores), memory (8 GB), and PID count (4096) are capped via mem_limit, cpus, and pids_limit to prevent resource exhaustion attacks.
tmpfs for /tmp — The /tmp directory is mounted as a 256 MB tmpfs, keeping temporary files in memory and preventing them from persisting to the container’s writable layer.
TLS validation on by default — NODE_TLS_REJECT_UNAUTHORIZED is not set, so Node.js validates TLS certificates by default. Users who need to accept self-signed certificates (e.g. for an internal proxy) can opt in by adding NODE_TLS_REJECT_UNAUTHORIZED=0 to their .env file.
SSH key umask — SSH private keys are written under umask 077, so the file is never world-readable — even briefly — between creation and the chmod call.

Security and Penetration Testing Tools

The container includes approximately 80 pre-installed security and penetration testing tools for authorized testing scenarios. Tools are organized by category:

Category	Tools (examples)
Network analysis	tshark, wireshark, masscan, hping3, bettercap (amd64), netdiscover
Web scanners	nikto, sqlmap, dirb, whatweb, sslscan, OWASP ZAP, dalfox, feroxbuster
Password and authentication	hydra, john, hashcat, medusa, ncrack
Reverse engineering	radare2, Ghidra, gdb, binwalk, strace, ltrace
Reconnaissance	subfinder, amass, httpx, nuclei, gau, waybackurls, recon-ng, spiderfoot
Fuzzing and enumeration	ffuf, gobuster, SecLists
Supply chain and secrets	trufflehog, grype, syft, gitleaks
Exploitation frameworks	Metasploit (amd64), searchsploit (ExploitDB)

Some tools (bettercap, Metasploit) are only available on amd64 due to upstream packaging constraints. Packet capture tools (tshark, bettercap) require the NET_ADMIN capability, which is included in the default docker-compose.yml.

For the complete list, run claude-self-test inside the container (section 7 checks all security tools).

Compliance Checklist

Requirement	Status
AI tools not installed on host endpoint	Yes
Runs in isolated VM or container	Yes
No access to host file shares	Yes
No clipboard sync	Yes
No shared credential stores	Yes
No VPN split tunneling into prod networks	Yes
Environment is disposable	Yes
No desktop extensions or plugins	Yes
Linux capabilities dropped (least-privilege)	Yes
Resource limits enforced (CPU/memory/PIDs)	Yes
TLS certificate validation enabled by default	Yes
Internal services bound to localhost only	Yes

Best Practices

Do not install AI coding tools on your host machine. Use this container instead.
Do not add bind mounts to docker-compose.yml. The named-volume configuration is intentional.
Rotate SSH keys used inside the container periodically.
Review .env before sharing. It contains API keys and may contain SSH private keys.
Update periodically to pick up security patches:

Docker
Podman

docker compose pull && docker compose up -d

podman-compose pull && podman-compose up -d