Repolode
Submit
nikvdp

nikvdp/cco

A sandbox wrapper that runs Claude Code (and other AI coding agents) with auto-approval inside native OS sandboxing or Docker, keeping your machine safer.

View on GitHub
Stars
429
Forks
32
Open issues
2
Last commit
26 days ago

What is it?

cco is a thin command-line wrapper that runs Claude Code inside a sandbox so it can work without repeated permission prompts while limiting what it can touch on your machine. It picks the best available backend automatically: sandbox-exec on macOS or bubblewrap on Linux when present, and Docker as a fallback. The native mode exposes the host filesystem read-only by default, while Docker mode only sees explicitly mounted paths.

The main problem it addresses is prompt injection risk when running Claude Code with permission checks disabled. Project files, state paths and git worktree metadata stay writable, and credentials are mounted at runtime rather than baked into images. Options such as --safe, --deny-path, --allow-readonly and --add-dir let users tighten or widen access. Network access is intentionally unrestricted, so the project is about filesystem and credential isolation rather than network control.

Beyond Claude Code, cco can wrap OpenAI's Codex CLI, OpenCode, Pi, and factory.ai's droid, and its --command flag runs arbitrary CLIs in the same sandbox.

Key features

  • 01Automatically selects sandbox-exec, bubblewrap or Docker based on what is available.
  • 02Native mode exposes the host filesystem read-only, with project directories writable.
  • 03Docker mode mounts only explicitly specified paths.
  • 04Supports git worktrees and macOS Keychain credential access.
  • 05Offers flags to hide, share or deny specific paths.
  • 06Wraps Claude Code, Codex, OpenCode and other agent CLIs with a single command.

Use cases

  • Running Claude Code with auto-approval on a laptop without exposing SSH keys or unrelated home directory files.
  • Letting an AI agent run tests or builds in an isolated environment.
  • Sandboxing any CLI tool via the --command option.
  • Using a persistent Docker container to keep installed tools between sessions.

Quick start

  1. 1

    Run the official install script from the README

  2. 2

    Run cco in your project directory in place of claude

    cco "write a hello world script"

Things to know

  • Native sandboxing exposes the entire host filesystem as read-only by default; use --safe for stronger isolation, which is experimental.
  • Some options, such as --docker-socket, weaken or defeat the isolation and are marked experimental.

In collections

Claude Code tools, skills & pluginsOpen-source AI agent frameworks & appsOpen-source Mac appsSecurity scanners, audits & threat intel tools

Topics

#claude-code#sandbox#ai-agent#docker#bubblewrap#security#macos#linux

FAQ

What is cco?
A sandbox wrapper that runs Claude Code (and other AI coding agents) with auto-approval inside native OS sandboxing or Docker, keeping your machine safer. cco is a thin command-line wrapper that runs Claude Code inside a sandbox so it can work without repeated permission prompts while limiting what it can touch on your machine. It picks the best available backend automatically: sandbox-exec on macOS or bubblewrap on Linux when present, and Docker as a fallback. The native mode exposes the host filesystem read-only by default, while Docker mode only sees explicitly mounted paths.
Is cco free to use? What license does it have?
cco is open source under the MIT license. Check the license terms before using it in commercial products.
Is cco still maintained?
Actively maintained. The last commit to cco was on Sep 29, 2026.
What can I use cco for?
Running Claude Code with auto-approval on a laptop without exposing SSH keys or unrelated home directory files. Letting an AI agent run tests or builds in an isolated environment. Sandboxing any CLI tool via the --command option. Using a persistent Docker container to keep installed tools between sessions.
How do I install cco?
Run the official install script from the README Run cco in your project directory in place of claude: cco "write a hello world script"
Where can I get cco?
The source code and installation instructions are on GitHub: https://github.com/nikvdp/cco

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects