Run Claude Code
in a box.
A Dockerized Claude Code you open in any browser. Let it run on auto — it can't touch anything outside /workspace, and its traffic is proxied, so it can't break your machine or phone your code home.
Let it run on auto.
The box has the keys.
claude-box ships in auto mode — Claude accepts its own edits and runs commands without stopping to ask. That's only comfortable because it's boxed: the worst it can reach is one folder, and it can't talk to anywhere you didn't allow.
- can't break— only /workspace is mounted; the rest of your disk is invisible.
- can't steal— all egress goes through a TLS proxy. No quiet exfiltration.
- can't escape— it's a Docker container, not your host shell.
Exactly what it needs. Nothing else.
A map of what the agent can and can't reach once it's in the box.
Batteries included.
Everything wired up on first run — auth, proxy, MCP servers, plugins, notifications.
Sandboxed in Docker
Claude Code runs in a container with only /workspace bind-mounted. The rest of your filesystem is never exposed.
Auto mode, without the worry
Ships with defaultMode: auto so Claude accepts its own edits and commands — safe to leave running because of the box around it.
Live session launcher
Every session on one page, grouped by folder, with auto-refreshing colored terminal snapshots — see what's working, done, or waiting.
Web terminal, any device
Claude Code over ttyd in the browser. tmux-backed sessions survive a closed tab or reboot; each one is deep-linkable.
Open it from your phone
claude-box --web --tunnel publishes the terminal over a public HTTPS URL via ngrok — drop in from your phone, anywhere.
It taps your shoulder
Browser notifications and a tab-title marker the moment a run finishes 🟢 or needs your input 🟡.
VS Code in the browser
claude-box --vscode runs code-server on /workspace with the Claude Code extension installed automatically.
Proxied egress
Claude → Anthropic traffic is routed through a TLS proxy; internal targets bypass it via NO_PROXY.
MCP servers, pre-seeded
GitHub, Atlassian, Sentry, context7, Kubernetes, Figma, Playwright and Grafana seeded into user scope on start.
Plugins & config carried
The superpowers plugin, your settings.json, theme and git identity ride along with the repo and apply on clone.
Your terminal, in any browser.
Open Claude Code over ttyd from a laptop, tablet, or phone. Sessions live in tmux, so they survive a closed tab or a reboot — and every one is deep-linkable, so a bookmarked URL drops you straight back in.
Need it off your LAN? claude-box --web --tunnel publishes a public HTTPS address through ngrok — check on a run from your phone while you're out.
Up and running in a minute.
Clone the repo
git clone github.com/
rcrvano/claude-boxLaunch the box
$ claude-box --webOpen in your browser
https://localhost:8443
Runs on your machine. Nothing leaves the box.
Your code and keys stay local. Egress is proxied, one folder is mounted, and the whole thing is open source under MIT. Self-host it, audit it, change it.
Box your Claude.
Isolated, durable, reachable from anywhere. One command to start.