valentinwust/ContainedClaude

own site.ini.
TL;DR
The agent, and everything it starts, reads everything you can read except credentials, writes only its
project folder and the folders you add, and runs cluster work only as Slurm jobs through cc-run. Those
jobs run in the same sandbox on the compute node.
Once: clone and run install.sh (below). Per project: containedclaude init DIR, then
containedclaude DIR; /login once in the first session.
On curry, projects lie below your home, /mnt/sds-hd/sd17l002/u/ or /mnt/sds-hd/sd17l002/p/. In a shared
folder everyone sets up their own sub-folder p/ / and shares data with --write.
Jobs get 4 CPUs / 32G / 4 h by default, at most 72 CPUs / 700G / 24 h each, and 4 GPU jobs at a time. A
session on the login node gets 32G of memory (/tmp included), 8 cores and 300 processes. Each project can
change these in .contained/config.ini.
containedclaude test DIR checks what should work, containedclaude doctor DIR what must be blocked, and
containedclaude update updates ContainedClaude, Claude Code and Codex.
> This is not perfect containment, so don't rely on it alone. It is a best effort against a confused or
> prompt-injected agent, not a proven security boundary, and it can't protect against bugs in the kernel,
> bubblewrap or apptainer. Don't give a contained agent data or credentials that must not leak (the network
> is open). Before you run anything from the project outside the sandbox, review what the agent changed; every
> session ends with a change report. Keep backups and version control. On curry, run every agent that can
> reach the SDS through ContainedClaude.
What exactly is allowed or blocked and why: EXPLANATIONS.md. How it works inside and how
to debug it: DEVELOPMENT.md.
## Install
Needs Linux with unprivileged user namespaces, bwrap, unshare, /usr/bin/python3 (3.6 or newer, no extra
packages), Claude Code, and for jobs Slurm and apptainer. Tested on curry (AlmaLinux 9, Python 3.9, bwrap
0.6.3, apptainer 1.5.5, Slurm 26.05).
bash
git clone https://github.com/valentinwust/ContainedClaude.git ~/ContainedClaude
~/ContainedClaude/install.sh # links containedclaude into ~/.local/bin, creates site.ini from site.curry.ini
On another cluster, start with ./install.sh site.example.ini and adapt site.ini (local, not in git):
partition, GPUs, shares to mount, limits and where projects may live. Uninstall:
~/ContainedClaude/uninstall.sh (--state also removes the contained Claude and Codex login and config),
then delete the clone. Projects stay normal folders.
Optional, both undone by uninstall.sh:
install.sh --shell-guard adds a line to ~/.bashrc (or ~/.zshrc): claude or codex typed in a
contained project asks first (Enter: contained, u: as usual; command claude skips it). cclaude and
ccodex start them contained in the current folder's project, cclaude server the Remote Control server.
install.sh --extras adds the compaction notice and idle compaction ([claude], see Configure) to your own
Claude Code too, in ~/.claude/settings.json, with the values of site.ini as they are then: run it again
after changing them.
## Set up a project
bash
containedclaude init ~/projects/myanalysis
# a shared project on the SDS: your own sub-folder is the project, the shared data folder is writable too