Ever been in this situation: Claude Code is grinding through a task, then suddenly pops up “Do you want to proceed?” You click Yes, take a sip of water, and boom — another prompt. By the end of one task, you’ve been interrupted seven or eight times. The work’s not done, but you’re definitely hydrated.
Give it full permissions? The urban legend of rm -rf / makes your hand tremble. Don’t give permissions? The tool becomes borderline useless.
The dilemma boils down to one thing: you want AI to work freely, but you’re terrified it’ll burn your house down.
Enter Code Container — an open-source project that solves this with Docker. Install it, and Claude Code, Codex, OpenCode — whatever harness you use — can rm -rf to its heart’s content. If something explodes, it’s the container that dies. Your machine doesn’t feel a thing.
The Afternoon That Broke Me
Here’s a real story. The author, Kevin, was analyzing a monorepo. The plan: Claude Code handles the backend, he handles the frontend. Parallel work, maximum efficiency.
The parallelism lasted about five seconds.
“Do you want to proceed?” — Yes. “Do you want to proceed?” — Yes again. “Do you want to proceed?” — Yes, through gritted teeth.
Five minutes later he realized: he wasn’t programming. He was working as AI’s front-desk security guard — his only job was nodding and saying “go ahead, go ahead.” He was waiting for AI’s output. AI was waiting for his approval. Mutual waiting, mutual losing.
It’s like having a kitchen assistant who turns to look at you after every single chop and asks “Is this cut okay?” — do you let them cut or not?
Three Roads. Pick One.
Faced with this problem, you’ve got exactly three options:
| Option | Approach | Outcome |
|---|---|---|
| A: Babysitter mode | Manually approve every prompt | You’re chained to the terminal, zero efficiency |
| B: YOLO mode | --dangerously-skip-permissions | Fast, but one stray rm -rf and you’ll learn a hard lesson |
| C: Container isolation | Run everything in Docker, rebuild on failure | Fast AND safe |
Option A is self-torture. Option B is gambling. Option C is exactly what Code Container does.
What Is Code Container?
In one sentence: mount your project directory into a Docker container, let your AI coding harness run wild inside, and keep your host machine untouched.
The idea is so simple it’ll make you slap your knee — if you’re scared of AI deleting things, just let it delete things, because it’s deleting them inside a container. Worst case? Delete the container and spin up a new one. Takes about a second.
# One-line install
npm install -g @aerovato/container
# Initialize (first run, ~5 minutes)
container init
# Then go into any project
cd /path/to/your/project
container
# You're in. Go wild.
The entire project is a pile of shell scripts and one Dockerfile. Fully open source. Core logic is under 300 lines.
How It Works
When you run container, here’s what happens under the hood:
- Create or resume a container: named
container-{project-name}-{path-hash}, one isolated container per project - Mount your project directory: mapped to
/root/{project-name}inside the container, code is immediately accessible - Mount AI tool configs:
.codex,.config/opencode,.claude— all config files and conversation history come along for the ride - Mount sensitive files read-only: SSH keys and Git config are read-only mounts, so commits and pushes work as usual
- Auto-stop on exit: container stops when you
exit, and next time you run it, everything is exactly where you left it
┌─────────────────────────────────────────┐
│ Your Host Machine │
│ ┌───────────────────────────────────┐ │
│ │ Docker Container │ │
│ │ /root/your-project ← mounted │ │
│ │ ~/.claude ← mounted │ │
│ │ ~/.ssh ← read-only │ │
│ │ │ │
│ │ AI runs wild in here │ │
│ │ rm -rf / ← kills the container, │ │
│ │ not your machine │ │
│ └───────────────────────────────────┘ │
│ Your machine stays untouched │
└─────────────────────────────────────────┘
Startup speed: first container creation takes about a second. Resuming an existing one is nearly instant. Kevin says he uses it daily and has never noticed any waiting time.
Hands-On: How to Use It
Say you have a Rust project called my-crate and want OpenCode to refactor a module.
Step 1: Install and Initialize
npm install -g @aerovato/container
container init
The init process walks you through choosing a runtime (Docker or Podman), configuring the base image, and picking tool packs to install. It’s fully interactive — just follow the prompts.
Step 2: Enter Your Project
cd ~/projects/my-crate
container
Once inside, you’ll find:
- Your project code at
/root/my-crate - Git config identical to your host — commit right away
- OpenCode / Codex / Claude Code all pre-installed, just type the command
- And — no more permission prompts. Give it full permissions and let it work.
Step 3: Run Multiple Containers in Parallel
This is the feature I find most useful. Open two terminals:
# Terminal 1: let Claude Code refactor the backend
cd ~/projects/my-monorepo/backend
container
# Fire up Claude and hand it the work
# Terminal 2: you work on the frontend
# Each doing their own thing, zero interruptions
You can even spin up multiple containers for the same project — one refactoring, one running tests, one writing docs. Each is an independent sandbox. Go nuts.
When Is This Most Useful?
Scenario 1: Inherited spaghetti code
Newly inherited project, and AI wants to rewrite everything right away. Would you let it touch your actual files? I wouldn’t. Throw it in a container. If it breaks things, so what — at least you’ll see what it was trying to do.
Scenario 2: Multi-harness parallel work
Claude Code for business logic in the morning, Codex for complex architecture in the afternoon, OpenCode for code review at night. Three tools sharing one set of configs and conversation history. No switching, no reconfiguring.
Scenario 3: Experimental projects
Want to see what happens if AI builds a project from scratch? Create a directory, run container, and let it go wild. Not happy with the result? docker rm and start over. Zero-cost experimentation.
Customization: Make the Container Yours
Code Container is fully open source. Modify it however you want. Clone the repo and tell your AI assistant what you need:
git clone https://github.com/aerovato/container
# Then let Claude Code customize it for you
Common customizations:
# Install Rust and Go toolchains inside the container
# Switch the base image to Alpine Linux (even smaller)
# Mount your ~/.vimrc into the container
# Add a hook that auto-installs project dependencies
The docs are thorough. Feed them to your AI assistant and it’ll understand what to change.
Final Thoughts
This tool’s approach is so straightforward you’ll wonder why nobody built it sooner. One container, a few shell scripts, and it solves one of the most annoying problems with AI coding tools.
After using it for a while, here’s my take: once you’ve experienced letting AI run wild inside a container, you can never go back to manual approvals. The peace of mind — “run whatever, nothing bad can happen” — and the freedom — “ignore it, I’ve got my own work to do” — are way better than you’d expect.
Of course, containers aren’t magic. They solve file-system-level safety — AI deleting files, writing garbage data, that kind of thing. For API calls, network access, and external services, you still need to keep an eye out. But with container isolation in place, at least you’ve locked the worst-case blast radius inside the container walls.
FAQ
Q: How is this different from running locally?
The biggest difference is peace of mind. Running locally, you’re always on edge. Running inside a container, your mindset completely shifts — “It broke? Rebuild it.” That mental shift directly determines whether you’ll actually let AI work freely. Claude Code’s built-in permission system is well-designed on its own, but adding container isolation on top is like wearing a belt and suspenders.
Q: Is there a performance hit?
Almost none. File I/O goes through bind mounts, nearly identical to local. The network stack reuses the host. Startup and teardown both complete in under a second.
Q: Can configs be shared across containers?
Yes. .claude, .codex, and other config directories are shared mounts. A skill you tune in project A is immediately available in project B. Conversation histories are shared too.
Q: Does Git work normally?
Perfectly. SSH keys and .gitconfig are mounted read-only from the host. Commit, push, pull — works exactly like local.
Q: Does it work on Windows?
Primarily supports Linux and macOS. Windows users can run it through WSL2’s Docker. The experience is slightly rougher but still functional.
Q: How does this compare to online services like cc-codex-portal?
These are two different approaches. Code Container tackles the permission and isolation problem for local AI coding tools. Online services (like Rexai Programming’s AI Coding Assistant ) tackle model access and cost — no API key juggling, no rate limit anxiety. They don’t conflict; you can even combine them: get model access through an online service, protect your local environment with containers.
At the end of the day, container isolation is about making AI tools work better for you. If you’re into AI-powered development, follow the “Full-Stack Summit - Rexai Programming” WeChat channel for weekly tips and tool reviews.
Also check out Rexai Programming AI Coding Assistant — one-stop access to Claude, Codex, GPT, and more. No API hassle, no quota headaches. Just open and go.
