A Lightweight Rootless Container Sandbox for Claude Code and Codex

What happened

I'll pull the source article and HN thread first so the paragraphs stay tied to named facts, not invented versions or figures.The Medium page is gated; I’ll pull the GitHub write-up and the author’s related sandbox notes so the technical claims stay sourced.Hideaki Takahashi published a Medium walkthrough of h5i, an integrated sandbox for coding agents, and the post reached Hacker News as item 49258898 with one point and no comments. The article’s claim is specific. The container tier runs Claude Code or Codex inside a rootless Podman container with every capability dropped, a read-only root filesystem, a pinned egress allowlist, and no daemon. h5i then owns the rest of the session: a disposable Git workspace, credential handling, network policy, execution records, and the export that brings work back to the host. The source is github.com/h5i-dev/h5i.

A sandbox is the security goal. A container is only one way to build it. Takahashi’s point is that a bare podman run or docker run is not a sandbox if you mount the home directory, expose the container engine socket, leave privileges in place, or leave the network open. h5i therefore starts from a separate Git worktree and mounts only that tree read-write at /work, so the original branch stays outside the agent’s writable path. The image starts with a read-only root filesystem and a private in-memory /tmp of 256m with nosuid and nodev. All Linux capabilities are dropped, no-new-privileges blocks later privilege gain, IPC is private, and userns keep-id keeps worktree files owned by the calling user. Profile limits become memory and PID ceilings. Images are never pulled at start, and the container is removed when the session ends. The host home directory and the Podman socket are never mounted.

The technical detail

This matters because Claude Code and Codex are useful precisely because they edit files, run shell commands, install packages, execute tests, start development servers, and operate a browser. Launched on a laptop, they inherit the power of the user who started them: repositories, shell configuration, SSH keys, cloud credentials, and browser state. The agent does not have to be malicious. It can misunderstand a task, follow instructions in an untrusted README, or install a package with a dangerous lifecycle script. Telling the agent to be careful is guidance, not a boundary. Isolating the whole process tree puts the agent, npm, build scripts, test runners, and child processes inside one restriction set. The other half of the boundary is the output gate. Changes leave as a reviewed patch.diff, report.md, and receipt.json rather than writing the original branch.

Why it matters for builders

The market already has containers and it already has agent-side sandboxes. Docker is the tool most developers know. Podman is daemonless and speaks the same OCI image format, which is why a Dockerfile usually builds under Podman. Docker also has a rootless mode, and Takahashi is explicit that this is not a claim that Docker is unsafe and Podman is safe. Security depends on the complete configuration. h5i’s container tier currently supports only rootless Podman so the project has one execution model to probe, configure, and make claims about. It does not run its own container daemon. It invokes the Podman already installed on the host. That is narrower than a generic container runner and broader than Codex’s inner sandbox, which the article treats as something to disable inside an already-confined box.

For a working loop, install h5i and rootless Podman, confirm podman info reports Rootless as true, and run h5i box probe. If you request isolation container and rootless Podman or the requested image is missing, h5i stops with an error instead of silently giving a weaker sandbox. The repository ships Containerfile.agent-claude and Containerfile.agent-codex. Create a box against a project, enter it with CLAUDE_CODE_OAUTH_TOKEN or OPENAI_API_KEY available to the host-side credential broker, and launch the agent inside. For Codex, start with sandbox danger-full-access. That flag turns off Codex’s additional inner sandbox because h5i worktrees keep Git metadata that is not entirely below /work, and Codex’s workspace-write mode can make that metadata read-only and break git commit. Full access from Codex’s point of view still means only the filesystem and network the h5i box exposes. After the session, status, diff, and export produce the review bundle. Applying the patch is a human step.

Market and competitive context

The container tier is aimed at accidental or runaway agent behavior and careless dependency code. It does not provide a separate kernel against a targeted kernel exploit. That is the microvm tier, which boots a guest through microsandbox. Egress on the container tier is Layer 7: an HTTP and HTTPS CONNECT proxy on the host accepts approved destinations, pins resolved names against DNS rebinding, and records allow and deny counts. Tools that honor the proxy are bound. A program that ignores the proxy and opens a raw socket is not. For that case the article points to the supervised tier, which uses a private network namespace and nftables pinned to resolved IPs plus a seccomp socket gate, or to microvm. Containment also does not stop source from going to an approved model API, and a secret a human places inside the box is unprotected. On Linux and WSL2, rootless Podman can run directly. On macOS, Podman runs Linux containers through a podman machine virtual machine.

What to watch next

What to watch is which tier teams actually pick. supervised is the faster Linux loop with Layer 3 and 4 network controls. container is the portable OCI-image path with memory and process ceilings and reviewable proxy activity. microvm is the hardware-isolated guest with its own kernel. h5i never silently downgrades an unsatisfiable request. Also watch whether the Layer 7 proxy hole on the container tier stays accepted, and whether Docker support remains out of scope. The Hacker News thread has no comments, so independent reports of Claude Code and Codex under this flag set are still absent.