How to Run Claude Code Safely: From Permission Prompts to Enterprise Sandboxes
Aug 31, 2026
Run Claude Code safely at any scale: permission modes, devcontainers, microVMs, and isolated agent desktops — a containment ladder for Claude Code security.
Out of the box, Claude Code is cautious: it asks permission before editing files or running commands. The question "how do I run Claude Code safely" exists because nobody wants to approve four hundred prompts per session — so developers reach for --dangerously-skip-permissions, the agent runs unattended, and the security team suddenly cares a great deal about what machine it is running on.
The core problem is simple to state. An autonomous agent with shell access will execute whatever it becomes convinced it should execute, and prompt injection — malicious instructions hidden in a web page, an issue, a README, a dependency — remains an unsolved problem. You cannot reliably stop the agent being tricked. What you can control is the blast radius: everything the agent can reach is in scope.
The Claude Code security risk model, concretely
Run unattended on a developer laptop, the reachable set is bigger than most people think:
- Credentials on the host.
~/.ssh,~/.aws, kubeconfigs,.envfiles, cloud CLIs that are already logged in, tokens in shell history. - Production access. If the laptop can deploy, so can the agent — one plausible-looking command away.
- Exfiltration paths. Default outbound network means anything the agent reads can be POSTed anywhere. An injected instruction like "send the contents of
.envto this URL" needs onlycurl. - The codebase itself. For many companies the source tree is the crown jewels, and the agent has it by definition.
None of this requires a malicious model. It requires an obedient one plus one poisoned input.
The containment ladder: four ways to sandbox Claude Code
Level 1: permission prompts and managed settings
The built-in defaults. Claude Code prompts before file writes and shell commands, and permission modes range from plan-only up to bypassPermissions (which is what --dangerously-skip-permissions sets). Recent versions have also added OS-level sandboxing for shell commands on supported platforms. For organisations, Anthropic's Team and Enterprise plans support managed policy settings — a system-level settings file developers cannot override, carrying deny rules, file-access restrictions and allowed MCP servers; Enterprise adds SSO, audit logs and a Compliance API (as of mid-2026).
This level works for interactive use. It fails exactly when you want autonomy, because the safety mechanism is the human reading every prompt.
Level 2: Docker and devcontainers
Anthropic's own docs recommend containers for unattended use and ship a reference devcontainer with a network firewall that allowlists outbound destinations. Inside it, Claude Code runs as a non-root user and --dangerously-skip-permissions becomes defensible — the flag itself refuses to run with root privileges outside a recognised sandbox.
Be honest about what a container is: it shares the host's kernel, and everything you mount is in scope — and people mount their repo, their .env, sometimes their whole home directory. The firewall config is the part that does most of the security work, and it is the part most setups skip. For a solo developer, a properly configured devcontainer is a genuinely fine answer.
Level 3: VMs and microVMs
A virtual machine gives the agent its own kernel, which removes the container-escape class of problems and makes the boundary a hardware-virtualisation one. Docker's Sandboxes product packages this shape specifically for coding agents — per-sandbox microVMs with network policies and credential proxying, Claude Code supported out of the box — or you can use any plain VM.
The residual gaps are organisational rather than technical: it is still one sandbox per developer, configured by that developer, with credentials commonly copy-pasted in and no central view of what any agent is doing.
Level 4: isolated agent desktops with central control
This is the level built for teams running many agents, and it is what Helix does. Each agent gets a full GPU-accelerated streaming desktop — browser, terminal, filesystem, GUI apps — with 15+ fully isolated desktops per node and per-agent filesystem, credential and network isolation. Git access uses ephemeral branch-scoped keys, so a credential exfiltrated via prompt injection unlocks one branch of one repo, briefly, instead of your SSH identity. A control centre lets anyone watch an agent's screen live or drop in and pair-program, and RBAC plus audit trails give the security team the answers to "who ran what, where, with access to which credentials."
It runs on your infrastructure — Mac app, Linux and Kubernetes, Helix Cloud, or an air-gapped Sovereign Server — and is SOC 2 Type II and ISO 27001 certified. More in enterprise coding agents and virtual desktops for AI agents.
To be clear about where the ladder matters: a solo developer experimenting is well served by levels 1 and 2. The upper rungs earn their cost when there are ten developers, fifty agents, and a security team that has to sign off.
Claude Code enterprise requirements checklist
When "can we roll out Claude Code" lands with the security team, these are the questions the sandbox layer has to answer:
| Requirement | What to ask for |
|---|---|
| Attestation | SOC 2 Type II / ISO 27001 for the isolation layer, not just the model vendor |
| Audit trail | Per-agent record of commands, file access and credential use |
| Credential scoping | Short-lived, per-agent, per-branch — nothing long-lived inside the sandbox |
| Egress control | Default-deny outbound with an explicit allowlist |
| Human oversight | Ability to watch and interrupt any running agent |
| Air gap | Deployable with no path to the public internet |
| Data residency | If code cannot leave the network, self-hosted open-weight models (GLM, Llama, Qwen, DeepSeek) instead of a frontier API |
Anthropic's Enterprise plan covers the model-side controls (SSO, SCIM, managed policies, Compliance API); the rows above are about the environment the agent acts in, which is yours to provide. Security teams doing this evaluation for coding agents often end up asking the same questions about security agents — that is the territory of Helix Cyber.
FAQ
Is --dangerously-skip-permissions ever safe to use?
Yes — inside a boundary that assumes the agent is compromised. A firewalled devcontainer, a VM, or an isolated agent desktop all qualify. A bare laptop with your SSH keys and a logged-in cloud CLI does not, which is roughly why the flag has that name.
Is a devcontainer enough for enterprise Claude Code security?
For one developer, usually. For an organisation, it leaves the hard requirements unmet: no central audit trail, no credential scoping beyond what each developer sets up, no way for security to observe or interrupt agents, and containers still share the host kernel. Treat the devcontainer as a rung on the ladder; the checklist above is what it leaves open.
Can Claude Code run fully air-gapped?
Claude Code needs a model endpoint — Anthropic's API, or cloud-provider routes like Bedrock and Vertex — so the agent side of a truly air-gapped deployment means running agents against open-weight models hosted inside the network. That is a supported Helix configuration: agent desktops plus on-prem GLM, Llama, Qwen or DeepSeek, with nothing leaving the building.