Comment by akashakya

For lightweight sandboxing on Linux you can use bubblewrap or firejail instead of Docker. They are faster and _simpler_. Here is a bwrap script I wrote to run Claude in a minimal sandbox an hour back:

    exec bwrap \
      --ro-bind /usr /usr \
      --ro-bind /etc /etc \
      --ro-bind /run /run \
      --ro-bind "$NODE_PATH" /node \
      --proc /proc \
      --dev /dev \
      --symlink usr/lib64 /lib64 \
      --tmpfs /tmp \
      --unshare-all \
      --share-net \
      --die-with-parent \
      --new-session \
      --bind "$HOME/claude" /claude \
      --bind "$HOME/.claude.json" /claude/.claude.json \
      --bind "$HOME/.claude" /claude/.claude \
      --setenv HOME /claude \
      --setenv PATH "/node:/claude/bin:/usr/bin" \
      --bind "$(pwd)" /work \
      --chdir /work \
      /claude/bin/claude "$@"