I'm fairly new to Docker and researching the safest way to run Claude Code alongside Ollama and Open Code on my Mac. I'm considering Docker Sandboxes (sbx) instead of running everything inside a VMware Fusion Pro virtual machine.
How well does sbx prevent an agent from accessing files outside the workspace I explicitly provide? I'm also concerned about an agent modifying the workspace in a way that could leave behind something malicious, such as altered Git hooks, scripts, or configuration files.
Finally, if Ollama is installed directly on macOS and listening on 127.0.0.1:11434, can a sandbox access it through host.docker.internal:11434? I'd appreciate practical advice or experiences with this setup.
3 Answers
For Ollama, a sandbox should be able to reach the Mac’s service through host.docker.internal:11434, but you may need to explicitly allow or forward that host port in the sandbox configuration. For example, the sbx network policy may require allowing localhost:11434 first. After that, configure the client inside the sandbox to use http://host.docker.internal:11434 rather than 127.0.0.1, since 127.0.0.1 inside the sandbox refers to the sandbox itself.
The main security boundary is the microVM and the permissions you grant, not simply the fact that the software is called Docker. Avoid sharing your whole home directory, SSH keys, credentials, or broad filesystem paths. Even with isolation, anything inside a writable workspace should be treated as potentially modified by the agent, so use version control, disposable copies, and careful review before executing generated code on the Mac.
Docker Sandboxes seem like a good fit because the agent runs inside a microVM rather than having ordinary direct access to your Mac filesystem. It should only see the directories you explicitly share. The important limitation is that shared workspaces are generally writable, so the agent can still create, delete, or modify anything inside them, including build scripts, Git hooks, and editor configuration.
For extra protection, use a clone-based workflow if available. Keep the original repository read-only, let the agent work in a disposable clone, and review anything before copying changes back or running scripts on the host.
That clears up the distinction I was trying to understand. I’ll look into using a disposable clone and reviewing the changes before bringing them back.