Name: aicontainer
Author: stefanoginella

aicontainer

A sandboxed devcontainer for running Claude Code, Codex, and OpenCode in bypass / auto-approve mode safely across multiple projects.

Why? Auto-approve is the only way these CLIs actually fly — but pointed at your real $HOME it also lets a prompt-injected dependency read .env, exfiltrate shell history, or push through your gh token. aicontainer puts the AI behind a devcontainer boundary so you can keep auto-approve on without rebuilding your machine each time.

What you get: filesystem isolation, a filtered Docker socket via Tecnativa's docker-socket-proxy, a minimal PreToolUse hook, and an opt-in iptables outbound allowlist. No AI-generated config, no per-project re-login. Defaults are listed in What's in the box so you know exactly what you're adopting.

Adjacent work: same shape as the Trail of Bits devcontainer, with Codex and OpenCode added, Docker access turned on by default, and host shell look-and-feel preserved.

What crosses the boundary

At a glance, what the in-container agent can touch on your host. Run aic preflight in any project to print this for your actual config (it's also shown automatically at the end of every aic up).

Surface	Crosses the boundary?
Project directory	Yes, read-write (`/workspace`) — the one writable host path.
`~/.gitconfig`, `~/.p10k.zsh`, `~/.zshrc.local`	Read-only (shell look-and-feel).
`~/.claude/settings.json`, `~/.codex/config.toml`, `~/.config/opencode/opencode.json`	Read-only seed — an allowlisted subset of fields; security-critical ones are force-overridden (and inline provider API keys are stripped from the OpenCode seed). See Config seeding.
Host home, `~/.ssh`, SSH-agent socket	No — not mounted, not forwarded.
Host credentials (API keys, `gh` token, keychain)	No — nothing auto-forwarded; you log in once inside the container.
Package-manager caches	No — container-local volumes, not your host caches.
Clipboard / browser	No — nothing bridged.
`.env*` files	Blocked from the agent by the PreToolUse hook. Your project's own `.env` is physically in `/workspace`, but the hook stops the agent from reading it — defense-in-depth at the tool layer, not a missing file.
Session transcripts	Persist in a per-project named volume, never written back to your host home. See Multi-project model.
Outbound network	Yes — fully open by default. Reaches the internet, your LAN, and cloud metadata (`169.254.169.254`). Opt in to the iptables allowlist to restrict it.

The full reasoning is in Threat model; the network row is the one most worth your attention.

Prerequisites

Docker runtime: Docker Desktop, OrbStack, or Colima.
Node.js 18+ (for npm and the bundled @devcontainers/cli).

One-time install

npm install -g aicontainer

That puts aic on your PATH and pulls @devcontainers/cli in as a dependency. To upgrade later: npm update -g aicontainer.

Try-before-install: npx aicontainer init works too, but aic up / aic shell / etc. are repeated commands — install globally once and you won't pay the npx download tax every time.

Prefer a git checkout? git clone https://github.com/stefanoginella/aicontainer ~/.aicontainer && ~/.aicontainer/install.sh still works — aic resolves its templates relative to its own location, so both layouts behave the same. With a checkout you'll also need npm install -g @devcontainers/cli separately, and aic upgrade does the git pull.

aicontainer

Popularity

What's Inside

README

aicontainer

What crosses the boundary

Prerequisites

One-time install

Shell completion

Confidence

Similar Plugins

tsk-help

deployment-engineer

claude-code-toolkit

fullstack-dev-skills

drawio-diagramming

planning-with-files

More by stefanoginella

auto-bmad

Popularity

Health & Quality

More by stefanoginella

auto-bmad

Similar Plugins

tsk-help

deployment-engineer

claude-code-toolkit

fullstack-dev-skills

drawio-diagramming

planning-with-files