Running Claude Code dangerously (safely) • Hacker News Board

Re: Running Claude Code dangerously (safely)

#31

Post by shakna » Tue, Jan 20, 2026, 1:12 PM UTC

crabmusket wrote: post #21

What is the consensus on Claude Code's built-in sandboxing? https://code.claude.com/docs/en/sandboxing#sandboxing > Claude Code includes an intentional escape hatch mechanism that allows commands to run outside the sandbox when necessary. When a command fails due to sandbox restrictions (such as network connectivity issues or incompatible tools), Claude is prompted to analyze the failure and may retry the command wit…

Afraid that it regularly bypasses requests for confirmation...

[0] https://github.com/anthropics/claude-code/issues/14268

[1] https://github.com/anthropics/claude-code/issues/13583

[2] https://github.com/anthropics/claude-code/issues/10089

Re: Running Claude Code dangerously (safely)

#32

Post by riadsila » Tue, Jan 20, 2026, 1:13 PM UTC

Koyeb has great resources about running Claude Code in sandboxes: https://www.koyeb.com/tutorials/use-claude-agent-sdk-with-ko...

Re: Running Claude Code dangerously (safely)

#33

Post by athrowaway3z » Tue, Jan 20, 2026, 1:15 PM UTC

`useradd claude`

Re: Running Claude Code dangerously (safely)

#34

Post by jeffrallen » Tue, Jan 20, 2026, 1:19 PM UTC

denysvitali wrote: post #26

Here's what I do (shameless plug): https://blog.denv.it/posts/im-happy-engineer-now/ This allows you to use Claude Code from your mobile device, in a safe environment (restricted Kubernetes pod)

Here's what I do (shameless plug, not an employee, just a satisfied user): https://exe.dev

Re: Running Claude Code dangerously (safely)

#35

Post by sixhobbits » Tue, Jan 20, 2026, 1:19 PM UTC

clbrmbr wrote: post #17

I have been running two or three Claude’s bare metal with dangerously skip permissions all day every day for two months now. It’s absolutely liberating.

same, it's made a couple of damaging mistakes but so far it has a better track record than me in terms of fat-fingering `rm` commands or what have you

Re: Running Claude Code dangerously (safely)

#36

Post by RobinL » Tue, Jan 20, 2026, 1:21 PM UTC

Does anyone have direct experience with Claude making damaging mistakes in dangerously skip permissions mode? It'd be great to have a sense of what the real world risk is.

Re: Running Claude Code dangerously (safely)

#37

Post by frankc » Tue, Jan 20, 2026, 1:23 PM UTC

I think this makes sense but I wonder if firecracker would work better than vagrant for this? I haven't used it before, though. I guess it might if you are trying to run gas town level orchestration.

Re: Running Claude Code dangerously (safely)

#38

Post by esperent » Tue, Jan 20, 2026, 1:25 PM UTC

Gazoche wrote: post #25

clbrmbr wrote: post #17

I have been running two or three Claude’s bare metal with dangerously skip permissions all day every day for two months now. It’s absolutely liberating.

Until it decides to delete your home directory: https://old.reddit.com/r/ClaudeAI/comments/1pgxckk/claude_cl...

You can use the /hookify plugin to add hooks for preventing dangerous commands like this.

Re: Running Claude Code dangerously (safely)

#39

Post by pixl97 » Tue, Jan 20, 2026, 1:25 PM UTC

Gazoche wrote: post #25

clbrmbr wrote: post #17

I have been running two or three Claude’s bare metal with dangerously skip permissions all day every day for two months now. It’s absolutely liberating.

Until it decides to delete your home directory: https://old.reddit.com/r/ClaudeAI/comments/1pgxckk/claude_cl...

You're not running it on a filesystem that takes snapshots and is easily reversible?

Re: Running Claude Code dangerously (safely)

#40

Post by azuanrb » Tue, Jan 20, 2026, 1:26 PM UTC

RobinL wrote: post #36

Does anyone have direct experience with Claude making damaging mistakes in dangerously skip permissions mode? It'd be great to have a sense of what the real world risk is.

One recent example. For some reason, recently Claude prefer to write scripts in root /tmp folder. I don't like this behavior at all. It's nothing destructive, but it should be out of scope by default. I notice they keep adding more safeguards which is great, eg asking for permissions, but it seems to be case by case.