Claude Cage: Docker Sandbox for Claude Code Security
What Claude Cage Does
A developer on r/ClaudeAI built a Docker container called Claude Cage to address security concerns when using Claude Code. The tool locks Claude into a single workspace folder, preventing it from accessing sensitive files outside that directory.
Security Problem Identified
The developer realized that every shell command Claude Code runs has the same permissions as the user account. This means Claude can read:
- ~/.ssh directory
- ~/.aws credentials
- Browser profiles
- Personal files
- .env files from other projects
How Claude Cage Works
The Docker container restricts Claude to seeing only your code and nothing else. It ships with:
- A claude md that loads every session with security rules including:
- No writing secrets to files
- No force-pushing
- No running destructive commands without confirmation
- A settings.json that blocks dangerous bash patterns
Setup and Development
Setup takes about 2 minutes if you have Docker installed. The developer used Claude Code to help build and polish the tool, and is open to suggestions for additional security rules.
The GitHub repository is available at: https://github.com/jcdentonintheflesh/claude-cage
📖 Read the full source: r/ClaudeAI
👀 See Also
Endo Familiar: Object-Capability Sandbox for AI Agents
Endo Familiar implements object-capability security for AI agents: agents start with zero ambient authority, receive only explicit references to specific files or directories, and can derive narrower capabilities in sandboxed code.
OpenClaw Security Approach Using LLM Router and zrok Private Sharing
A developer shares their approach to running OpenClaw and an LLM router inside a VM+Kubernetes environment with a single command, addressing security concerns by injecting API keys at the router level and using zrok for private sharing instead of traditional messaging app tokens.
Static Analysis of 48 AI-Generated Apps: 90% Had Security Vulnerabilities
A developer scanned 48 public GitHub repos built with Lovable, Bolt, and Replit. 90% had at least one vulnerability. Common issues: auth gaps (44%), SECURITY DEFINER Postgres functions (33%), BOLA/IDOR (25%), and committed secrets (25%).
AI Auditor zkao Finds Critical Soundness Bug in OpenVM's zkVM Guest Library
ZK/SEC's AI auditor zkao found a critical soundness bug in OpenVM's pairing library allowing a malicious prover to forge pairing equalities, fixed in OpenVM 1.6.0 (CVE-2026-46669).