Privacy Risks in Claude Code? Use Docker Sandboxes to Fully Isolate Your AI Coding Tools

The Incident: Claude Code Found to Monitor User Behavior

A trust crisis recently erupted in the AI coding community. According to analysis shared by developers online, Anthropic has been banning Claude user accounts en masse — some users find themselves banned immediately upon registration, unable to use the service at all.

Even more alarming, developers discovered that Claude Code contains built-in logic specifically designed to detect the use of relay APIs: if Claude Code's base URL environment variable is pointed at a third-party proxy site, the tool uses methods like detecting the system timezone to determine whether the user is in China, then marks them by modifying prompts, ultimately banning all Claude accounts associated with that relay API.

What is a relay API? A relay API (also called an API proxy or API relay) is a solution that routes user requests to Anthropic's official endpoints through a third-party server. Because Anthropic's official service faces access restrictions or payment barriers in some regions, a large number of third-party platforms have emerged offering Claude API proxy services. These platforms typically purchase official API quotas and resell them at lower prices, or reduce costs by pooling multiple accounts. From Anthropic's perspective, relay API services violate their terms of service regarding account sharing and commercial resale, so large-scale banning makes sense from a business standpoint. However, embedding behavioral monitoring code into a client-side tool to achieve these bans raises a deeper trust issue — it means the AI tool itself may become a vector for data collection.

While this behavior primarily targets relay API sites rather than individual users, it exposes a more troubling reality: Anthropic's official tools are technically capable of collecting user environment information. The related posts spread rapidly, garnering over 400,000 views. Although Anthropic has since removed the timezone detection code in the latest version, they've also confirmed that stronger detection mechanisms will be introduced.

This means we cannot be 100% certain that the Claude Code binary doesn't contain more covert logic targeting user privacy and sensitive data. And this isn't unique to Claude Code — Codex, Copilot, and other mainstream AI coding tools all face the same trust dilemma.

The Solution: Isolate AI Tools with Docker Sandboxes

The most reliable way to address these risks is to run AI coding tools inside a sandbox environment. This article covers hands-on testing of Docker Sandboxes (sbx) — an official Docker product specifically designed for sandboxed isolation of AI coding agents.

A Five-Layer Security Architecture

The core security mechanism of Docker Sandboxes is that each AI agent runs inside an isolated MicroVM (micro virtual machine), with its own dedicated kernel, independent Docker engine, and isolated network environment. This means there are five layers of physical isolation between the AI coding tool and your host operating system.

Why are MicroVMs more secure than regular containers? A MicroVM is a lightweight virtualization technology that sits between traditional virtual machines and containers. MicroVM solutions like AWS Firecracker achieve millisecond startup times by minimizing the virtual device model, while maintaining complete hardware virtualization isolation boundaries. Unlike regular Docker containers — which share the host kernel and are therefore vulnerable to kernel exploit-based escapes — MicroVMs give each instance its own independent Linux kernel. Even if an attacker exploits a kernel vulnerability, they can only compromise the virtual kernel, not the host system. This "one kernel per workload" design is the foundation for Docker Sandboxes' five-layer isolation: host OS, hypervisor, virtual kernel, independent Docker engine, and container layer — each serving as an independent security barrier.

Claude Code runs inside this dedicated kernel, and all its operations are confined to the sandbox. Even if Claude Code contains malicious code, it cannot escape the sandbox and therefore has no way to access private data on the host OS.

This approach also blocks another class of risk: if any Skills packages or MCP services installed for AI tools contain hidden malicious scripts, those scripts will be locked inside the sandbox as well, preventing privacy leaks or system compromise.

Supports All Major AI Coding Tools

Testing confirms that Docker Sandboxes currently supports Claude Code, Codex, Copilot, Cursor, Kiro, OpenCode, and other mainstream closed-source and open-source AI coding tools — quite comprehensive coverage.

Installation and Configuration: macOS, Windows, and Linux

Docker Sandboxes supports macOS, Windows, and Linux, with a straightforward installation process.

Basic Installation

On macOS, simply copy the official installation command, open a terminal, paste, and run. For users who prefer not to use the command line, there's a clever workaround: hand the installation command directly to Codex or Claude Code and let the AI handle it — just type a prompt like "Help me install Docker Sandboxes using this command" and paste the command.

Windows and Linux users should use the platform-specific commands provided by Docker.

Critical Step: Disable Telemetry

After installation, there's an important step that's easy to overlook: run the dedicated command in your terminal to disable Docker Sandboxes' telemetry.

What does telemetry mean? In software, telemetry refers to a tool automatically collecting and reporting user behavior data back to the developer, typically including feature usage frequency, error reports, performance metrics, and system environment information. Many tools' telemetry implementations are opaque — what fields are collected, how long data is retained server-side, and whether it's shared with third parties are often left technically unclear. Docker Sandboxes provides an explicit command to disable telemetry, which is a better privacy practice than most tools offer. Once disabled, sbx will no longer collect user information and report it to official servers. Since the whole point of using a sandbox is to prevent privacy leaks, this step should never be skipped.

Hands-On Testing: Claude Code Locked Inside the Sandbox

Once configured, navigate to your project directory and run the corresponding command to launch Claude Code inside the sandbox. Because the tool is isolated, you can safely grant Claude Code full permissions (skipping per-action confirmation prompts) without worrying about it accessing sensitive information.

Escape Tests: All Failed

Several "escape tests" were conducted to verify the sandbox isolation:

• List desktop files: Claude Code reported it couldn't see the desktop, explicitly stating the current session is running inside a Linux sandbox;
• Query OS information: Unable to retrieve specific host machine system information;
• Clear the Downloads folder: Reported that no Downloads directory exists;
• Read Chrome browser cookies: Reported that Chrome is not installed in the sandbox and no cookies could be accessed.

On the security boundaries of sandbox escape: Sandbox escape refers to a malicious program breaking through isolation boundaries to gain access to systems outside the sandbox. MicroVM architecture introduces an additional layer of physical isolation into the escape path via hardware virtualization — an attacker would need to simultaneously exploit both a guest kernel vulnerability and a hypervisor vulnerability to achieve a complete escape, which is extremely rare in practice. The tests above verify functional isolation under normal usage scenarios, which is more than sufficient to defend against common privacy threats like built-in monitoring code in AI tools.

These tests conclusively demonstrate that even with full permissions granted, Claude Code remains confined to the sandbox and cannot escape to access any unauthorized files or data on the host machine.

Full Functionality Intact

Functional completeness is also preserved under sandbox isolation. Test results:

• Clone and analyze open-source projects: Can normally clone GitHub repos, have Claude Code analyze issue root causes, and switch to more cost-effective models (e.g., Claude Sonnet);
• Agent view (multi-task): Adding the --agents flag launches Agent view inside the sandbox, allowing you to track multiple tasks simultaneously;
• MCP services: Successfully installed and invoked Playwright MCP, validating front-end debugging through a login page demo. Critically, Playwright MCP debugs a browser instance inside the sandbox — it never touches the user's local Chrome browser, completely isolating real browser cookies and other private data.

Version Updates and Multi-Tool Management

Updating Claude Code inside the sandbox is straightforward: exit the current instance, use sbx ls to list created sandbox names, then run claude update on the target sandbox to upgrade to the latest version (tested up to v2.x).

Beyond Claude Code, Codex and OpenCode were also successfully run inside sandboxes using essentially the same process. sbx ls provides a clear view of all created sandboxes along with their corresponding agent types and paths.

Limitations and Reflections

The sandbox approach does come with trade-offs. The most obvious limitation: you cannot directly call the real Chrome browser running on your host machine. When using tools like Playwright for front-end debugging, the sandbox runs an independent browser instance that is completely isolated from your local browser's login state, bookmarks, and extensions — which creates friction for debugging scenarios that depend on a real browser environment.

From a security perspective, though, this is precisely the isolation mechanism working as intended — you can't have it both ways.

The deeper takeaway: as AI coding tools grow increasingly powerful and gain broader permissions, their access to local code, secrets, and browser data continues to deepen. Modern AI coding tools require permissions that far exceed those of traditional IDE plugins — Claude Code in agent mode, for example, can execute shell commands, read and write arbitrary files, manage Git repositories, call network services, and operate browsers. This is essentially granting an autonomous agent with full operating system-level permissions. This "agentic AI" trend introduces two primary security challenges: supply chain risk, where the tool itself or its MCP service dependencies contain malicious code; and prompt injection attacks, where malicious content tricks the AI agent into performing unintended actions. Sandbox isolation effectively mitigates the first category; defending against the second remains an open problem in AI security research.

Whether a vendor is trustworthy and whether a binary is clean are things users can rarely verify on their own. In this context, running AI agents inside a sandbox is evolving from a "geek option" into a necessary security practice.

For developers working on sensitive projects, enterprise code, or personal private data, Docker Sandboxes offers a low-barrier yet solid isolation solution well worth incorporating into your daily workflow.

Key Takeaways