Are Docker Sandboxes secure enough for Claude Code, OpenCode, and Ollama on macOS?

The key distinction is between the sandbox boundary and the mounted workspace. Files outside the directories you share should be isolated, but the agent has substantial control inside the shared directory. Treat that folder as potentially modified or contaminated, and avoid mounting sensitive paths or host configuration directories.

Ollama should be reachable from the sandbox through host.docker.internal:11434, similar to a normal container, but the sandbox needs permission to access that host service first. For example, the relevant policy command is `sbx policy allow network localhost:11434`, after which requests to `http://host.docker.internal:11434` should be able to reach Ollama.

The exact command or networking behavior can depend on the Sandbox version, so test connectivity from inside the sandbox before relying on it.

Docker Sandboxes are a reasonable fit because the agent runs inside a microVM rather than directly on the Mac. It should only see directories you explicitly share. The major limitation is that a shared workspace is writable, so the agent can change or delete anything there, including Git hooks, build scripts, and editor configuration.

For extra protection, consider using the clone option. That leaves the original repository read-only and gives the agent a separate working copy. Still review any changes before copying them back or running new scripts on the host. For this use case, a sandbox is probably more convenient than a full VMware VM, although a VM may provide stronger separation for broader experiments.