↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Sandboxing/

aicontainer

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 5 minutes read (~859 words)
agent-curated 512 containers 5 devcontainer 1 fully-ai-generated 615 isolation 19 llm=glm-5.3-flash 523 open-source 165 research-note 482 sandboxing 29
Table of Contents

aicontainer is an MIT devcontainer-spec CLI that runs Claude Code, Codex, and OpenCode in bypass mode inside a per-project dev container, with the Docker socket proxied, host config sanitized, and nothing from your home mounted.

It is the only member of the category that treats the Docker daemon itself as part of the threat model: by default the agent reaches it through a digest-pinned socket proxy exposing nothing but ping and version.

What it is
#

An npm-distributed CLI (aic, package aicontainer, bundled with @devcontainers/cli) that generates and maintains a .devcontainer per project and manages the agent’s life inside it: aic init, aic up, aic shell, aic sync, and a aic preflight that prints the exact boundary for your actual config. The boundary table answers, per surface, what crosses: the project directory read-write (with .devcontainer/ and the repo’s git control files read-only), host home and .ssh never, credentials never auto-forwarded (you log in once inside the container), and host git, Claude, Codex, and OpenCode config reduced to a fixed set of safe fields by a root-only, networkless one-shot sanitizer before the agent sees them. An always-on block covers IPv4 and IPv6 link-local and common cloud-metadata endpoints; outbound network is otherwise open unless you opt in to the allowlist; a PreToolUse hook stops the agent from reading .env files; session transcripts persist in a path-unique per-project volume. Solo author (Stefano Ginella), first published 2026-05-22, positioned by its own README as the same design as Trail of Bits’s claude-code-devcontainer with Codex and OpenCode added, three explicit Docker-access modes, and managed shell startup.

Status
#

The thinnest footprint in the category’s admitted set after aigate: 20 stars as of 2026-10-12, solo author, created 2026-05-22, pushed 2026-10-12, MIT.

Star History Chart

npm carries 0.9.1 (2026-10-05) with 401 downloads in the trailing month (2026-09-11 to 2026-10-10), and I found no Hacker News thread for the project. Development is active to a degree the star count hides: commits landed through 2026-10-11, and the messages document threat-model reasoning (a probe that fails closed against Node-manager shims, an npm 12 packaging fix) in unusual detail. Twenty stars is a missing-community-footprint signal by the category’s own standard, carried here by boundary documentation that reads like an audit candidate rather than by adoption.

Strengths
#

  • The socket proxy: a digest-pinned Tecnativa docker-socket-proxy leaves only ping and version reachable by default, with --docker-read and --docker opting into sensitive APIs, so a container escape cannot drive the host daemon.
  • The boundary is printed, not promised: aic preflight states what crosses for your actual config, and the same table renders after every aic up.
  • The config sanitizer: host agent and git config pass through a root-only, networkless one-shot that strips inline credentials, MCP env and headers, and security-policy fields.
  • Devcontainer-spec native: the boundary lives in the .devcontainer/ your editor already understands, so VS Code’s Reopen in Container workflow and the devcontainer toolchain apply unchanged.

Cautions
#

  • Twenty stars and 401 npm downloads a month: no community review has happened, and the solo maintainer is a bus factor of one.
  • Outbound network is mostly open by default; the allowlist that restricts it is opt-in, which the README itself flags as the row most worth your attention.
  • The .env block is a tool-layer hook, defense-in-depth rather than a filesystem guarantee, and a bypass-mode CLI that ignores hooks defeats it.
  • The container boundary shares the host kernel, with no audit and no independent discussion of the claims.

Pricing
#

Free and open source under MIT; the costs are Docker host resources and image builds. No hosted tier or pricing page exists as of 2026-10-12.

Compared to
#

  • Yolobox: the container wrapper with full sudo and an unmounted home; Yolobox is simpler, aicontainer adds socket proxying, config sanitizing, and the printed boundary table.
  • Container Use: agent-created environments on their own branches for parallel work; aicontainer is one fixed dev environment per project.
  • Fence: the OS-native wrapper that needs no Docker at all; choose Fence when containers are the overhead you are avoiding.

Bottom line
#

Recommended for VS Code-centered engineers who want auto-approve CLIs across many projects with the Docker daemon and host config explicitly handled, and who will read the threat model themselves. Not for anyone needing a kernel or VM boundary, an audited isolation claim, or a project with a community behind it.

Changes
#

  • 2026-10-12 - Created from the 2026-10-12 awesome-claude-code scan, profiling the devcontainer-spec entrant with the socket-proxy boundary recorded as the distinguishing mechanism and the thin footprint recorded as the signal.

See also
#

  • Sandboxing Feature Matrix - the category comparison this note joins
  • Yolobox - the other container-boundary member, coarser but more adopted
  • Container Use - the container boundary in its agent-created, per-branch form
  • aigate - the other small-footprint member kept for its reference design

References
#