A Lightweight Rootless Container Sandbox for Claude Code and Codex

What happened

I'll read the source article and the site's post-writing rules so the paragraphs stay factual and match the required structure.The Medium page is blocked, so I’ll pull the project site, GitHub repo, and the related write-up for names and mechanics I can cite.The Medium page is behind a challenge, so I’ll pull the author’s comparison post and the project docs for architecture details I can cite without inventing numbers.The first half of the Medium piece is enough for the architecture, but I still need the credential-proxy and network-allowlist sections before I write.Koukyosyumei, a Columbia PhD researcher in AI and system security also publishing as Hideaki Takahashi, posted a Medium article titled A Lightweight Rootless Container Sandbox for Claude Code and Codex. The write-up is the source behind Hacker News item 49258898, listed with 1 point and 0 comments. It describes h5i’s container tier, which runs Anthropic Claude Code or OpenAI Codex inside a rootless Podman container with every capability dropped, a read-only root filesystem, a pinned egress allowlist, and no daemon on the host. h5i is an integrated sandbox for coding agents. It creates the disposable Git workspace, keeps credentials and network policy on the host side, records execution, and controls export, then invokes the Podman already installed on the machine. The motivation is specific. These agents can edit files, run shell commands, install packages, execute tests, start development servers, and operate a browser, so an unconfined session inherits the operator’s repositories, shell configuration, SSH keys, cloud credentials, and browser state. The agent need not be malicious. It can misunderstand a task, follow an untrusted README, or install a package with a dangerous lifecycle script.

Takahashi treats a sandbox as the security goal and a container as one Linux mechanism for it. Namespaces, user-ID mappings, mount isolation, and resource controls give a process a separate view of the system, but a default podman run that bind-mounts the current directory as /work still writes the real project. h5i first creates a disposable Git worktree and mounts only that tree read-write at /work, leaving the original branch and the user’s HOME outside. The Docker or Podman socket is never mounted. The image starts read-only, with a private 256m tmpfs at /tmp using nosuid and nodev. Privileges come off with cap-drop=ALL, no-new-privileges, a private IPC namespace, and userns=keep-id so worktree files stay owned by the calling user. Profile ceilings become memory and pids-limit. pull=never refuses an implicit image fetch at start, and rm deletes the container on exit. Model credentials stay on the host. A runtime-scoped proxy attaches the real secret only to approved outbound requests; the box sees a dummy or scoped token. When a profile sets net.egress, an HTTP/HTTPS CONNECT proxy accepts approved destinations, pins resolved hosts against DNS rebinding, and records per-host allow and deny counts for the receipt.

The technical detail

That assembly is what builders need from an agent runtime. A coding agent is not a restricted shell. It needs compilers, package managers, language runtimes, browser dependencies, Git, and project tools, and every child process has to stay inside the same boundary. Telling the model to be careful is guidance, not confinement, and per-command approval makes the operator the policy engine for work they never see. The output path is part of the sandbox. Changes do not land on the original branch. After the session, h5i box status and h5i box diff show the enforced policy and the tree, and h5i box export writes patch.diff, report.md, and receipt.json. Applying the patch is a human step, for example git apply --3way on the exported diff. The same design keeps SSH keys, GitHub tokens, cloud credentials, and a personal browser profile out of the box. For teams that already think in OCI images, the container also packages the toolchain so the same Claude Code or Codex environment can run on a laptop, a colleague’s machine, or CI without a long host bootstrap.

Why it matters for builders

The comparison in the article is about execution models, not brand loyalty. Conventional Docker sends the CLI through a long-running daemon. Podman is daemonless, and h5i’s container tier currently supports only rootless Podman so the project has one runtime to probe and make claims about. Takahashi notes that Docker also has a rootless mode and that safety is the full configuration. Claude Code and Codex already ship inner sandboxes. Inside an h5i box, Codex is started with sandbox danger-full-access, which disables only that inner sandbox. h5i worktrees keep Git metadata that is not entirely below /work, and Codex’s own sandbox can make that metadata read-only and break git commit. Full access from Codex still means only the filesystem and network the outer rootless container exposes. The project’s other rungs sit beside this one. supervised is the faster Linux loop with filesystem, syscall, and Layer 3/4 network controls. microvm is a hardware-isolated guest with a separate kernel. container is the choice when a portable OCI image, real memory and process ceilings, and reviewable proxy activity are the requirement.

Market and competitive context

The try path is a short sequence. Install h5i from the install script on h5i.dev, install Podman from its official instructions, confirm Host.Security.Rootless is true, and run h5i box probe. An explicit request for isolation container fails if rootless Podman or the requested image is missing; h5i does not silently give a weaker sandbox. On Linux and WSL2, rootless Podman runs directly. On macOS, Podman runs Linux containers through a podman machine virtual machine. The repository ships Containerfile.agent-claude and Containerfile.agent-codex. Create the box with profile agent-claude or agent-codex, isolation container, and the local image, then enter it with CLAUDE_CODE_OAUTH_TOKEN from claude setup-token or with OPENAI_API_KEY. Launch claude or codex inside. What to watch is the mismatch between what teams assume a container allowlist does and what Layer 7 actually binds. If the first unacceptable failure is a raw socket to an off-list host, the article points at supervised or microvm, not a tighter CONNECT proxy. If the first unacceptable failure is a shared-kernel exploit, only microvm changes that line.

What to watch next

The container tier is written with an explicit non-claim list, and those gaps are the residual risk. It targets accidental or runaway agent behavior and careless dependency code. It does not provide a separate kernel against a targeted kernel exploit, because containers share the host Linux kernel. It does not block a program that ignores the proxy and opens a raw socket. It does not protect a secret a human places inside the box, and it does not stop approved model-API traffic from carrying source code. Prior art is the ordinary dangerous container: a writable root filesystem, a home-directory mount, an exposed engine socket, or unrestricted egress. h5i does not invent a new kernel primitive. It assembles rootless Podman flags, a disposable worktree, a credential broker, a fail-closed probe, and a review gate so that running Claude Code or Codex in a container is a sandbox around the whole workflow rather than an image that happens to contain the agent.