hardened-shell
OfficialRun agents safely in a read-only Docker sandbox
Authorspinlockdevelopment
Version1.0.0
Installs0
System Documentation
What problem does it solve?
Provides a reproducible, locked-down environment to run Claude or other agents without risking host writes or exposing host credentials, enabling banshee-mode agent productivity while containing blast radius.
Core Features & Use Cases
- Read-only host mount at /host with a project-only writable workspace at /work to prevent unintended host modifications.
- Blocklist masking of sensitive host paths and files so agents cannot read common credential stores.
- Per-project persistent Claude state seeded from a home template, plus launcher, image build, install, verify, and self-heal scripts to maintain a pinned, auditable runtime.
- Use cases: run one-shot agents, debug agent workflows, or provision ephemeral development sandboxes safely.
Quick Start
Build the image, install the launcher, and verify health by running the build-image, install, and verify scripts in the skill directory in sequence.
Dependency Matrix
Required Modules
docker
Components
scripts
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: hardened-shell Download link: https://github.com/spinlockdevelopment/dev-setup/archive/main.zip#hardened-shell Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.