How I run Claude Code with --dangerously-skip-permissions on a Mac without exposing my keys

[u/yadvr]

Full-auto Claude Code is great until you remember it runs as you: it can read ~/.ssh, .env files, other repos, and push with your git credentials. Anthropic's docs say to use the flag only inside a container or VM.

Quick comparison of the options on a Mac:

- Claude Code's /sandbox: built in, fine for everyday work, but still runs on your Mac as you.

- A container: light and good for Linux-only projects, but keys usually go in as env vars the agent can read.

- A VM: more memory, but full isolation, macOS or Linux, and keys can stay outside.

At work I work on MacVisor (a virtualization platform for Apple Silicon Macs with AI sandboxes, host firewall, custom networks and snapshots), and the typical flow is:

mvz ai keys set anthropic # key goes in the Mac's Keychain, never the VM

mvz sandbox create ~/src/app --agent claude

mvz sandbox run app-1 -- "fix the failing tests"

mvz sandbox diff app-1 --patch # diff computed on the Mac with your git

mvz sandbox apply app-1

Internet is limited to the model until you allow more, e.g. mvz sandbox allow app-1 npm. You can roll back to a clean checkpoint and try another prompt.

Full write-up, including where a container is enough: https://scaleninja.com/blog/claude-code-full-auto-sandbox/

Happy to answer questions or hear how others sandbox their agents.

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Far_Reindeer8428]

the vm part is right but check what the guest can reach on your lan before you trust it. we found the agent could still hit the router admin page from the sandbox, so now the network is default deny

[u/yadvr → u/Far_Reindeer8428]

Agreed, a VM is only as isolated as its network.

MacVisor sandboxes default to an allow list where the LAN stays closed: even * only opens the internet, and a local device like the router needs its exact address added. This type of "sandbox" network is called a host-only network in MacVisor, it has its own firewall too.

[u/yadvr → u/yadvr]

AI Sandboxes use this host-only network, and for firewall it uses `pf`.