Isolated Docker environment with safety features, logging, and maximum autonomy for Claude Code - protects users and hosts while enabling demos, experiments, and remote work
A secure, isolated Docker environment that gives Claude Code maximum autonomy while protecting both the host machine and inexperienced users from potentially dangerous operations. Designed for sales engineers, field engineers, CTOs, and anyone who wants to experiment safely with Claude Code.
This skill configures and manages a Docker-based development environment with comprehensive safety features including secrets scanning, git hooks, command logging, and container isolation. It's perfect for demos, customer environments, and remote work where safety and transparency are critical.
The environment organizes files as follows:
```
claude-yolo/
├── src/claude_yolo/ # Python package (CLI tool)
├── terraform/azure/ # Azure infrastructure modules
│ ├── acr/ # Azure Container Registry
│ ├── aci/ # Azure Container Instances
│ ├── vm/ # Virtual Machines
│ └── scripts/ # Helper scripts
├── examples/ # Demo applications
├── demos/sales-engineering/ # Sales demo scripts
├── docs/ # Documentation
└── .github/workflows/ # CI/CD pipelines
```
**Safe to edit:**
**Read-only:**
**Never modify:**
**Note:** On Linux hosts, files created by the container are owned by UID 1001. Use `sudo chown -R $USER ./home` if needed.
Choose the appropriate networking mode based on your use case:
**When to use:** Multi-container setups (databases, Redis, microservices)
**Pros:**
**Cons:**
**Config:** Uses `networks: - claude-network` in docker-compose.yml
**When to use:** Single-container setup requiring MCP server authentication (Atlassian, GitHub MCP servers)
**Pros:**
**Cons:**
**Config:** Use `claude-yolo run --mcp` flag or manually edit docker-compose.yml
**Why this matters:** Claude Code uses random ephemeral ports (49152-65535) for OAuth callbacks. Exposing this full range causes container startup hangs (hours) or failure, 16GB+ RAM consumption, and thousands of iptables rules.
```bash
/home/developer/scripts/setup-project-safety.sh /workspace/my-project
tail -f /logs/safety/checks.log
tail -f /logs/git/operations.log
tail -f /logs/commands/commands.log
uv init .
uv add <package>
uv run pytest
```
Deploy to Azure using OpenTofu/Terraform modules:
```bash
cd terraform/azure/acr
tofu init && tofu apply
cd ../scripts
./push-to-acr.sh --terraform-dir ../acr --project-dir /path/to/project
cd ../aci # or ../vm for Virtual Machine
tofu init && tofu apply
```
**Cost estimates:**
The environment includes:
**Core:** git, gh, jq, ripgrep, vim, nano, tmux, htop, tree
**Cloud:** aws, az, gcloud
**Kubernetes:** kubectl, helm, k9s, docker, docker-compose
**IaC:** terraform, tfsec
**Databases:** psql, mysql, redis-cli, mongosh
**Python:** uv, ruff, mypy, pytest, bandit, pre-commit
**Security:** gitleaks, detect-secrets, trivy
**Networking:** tailscale, openvpn, cloudflared, ttyd
When working in this environment:
1. **Safety First**: Every action should consider security implications - this environment protects inexperienced users
2. **Logging**: All operations are logged for transparency - use this to build trust
3. **Balance**: You have maximum autonomy within the safety constraints - use it wisely
4. **Documentation**: Keep CLAUDE.md and README.md updated when adding capabilities
5. **Infrastructure Focus**: Most changes involve Dockerfile, docker-compose, or shell scripts
6. **User Protection**: Target users may be disconnected from architecture details - protect them from mistakes
This environment is specifically designed for users who may not fully understand the architecture. Always prioritize their safety and provide clear explanations of what you're doing.
Leave a review
No reviews yet. Be the first to review this skill!
# Download SKILL.md from killerskills.ai/api/skills/docker-based-claude-code-safety-environment/raw