Sandbox an unattended Claude Code loop

Goal: Run a coding agent with skipped permissions without risking my machine.
Setup: agents used in source: Claude, Codex; tools/MCPs stated: Docker, git bundle.
Steps:
1. Put the agent in a container on a Docker --internal network; the only way out is an allowlist proxy that tunnels TLS on 443.
2. Never mount the Docker socket; run as an unprivileged user; keep webhook URLs out and post notifications from the host.
3. Before each run, snapshot the repo to a hidden git ref plus a git bundle outside the mount.
4. Run the Ralph loop: same prompt, fresh session, one task per iteration until the PRD is done.
5. Give the QA agent no edit tools; if Claude hits a usage limit, let Codex take over with its own three attempts.
Rules: ask me before anything irreversible (sending, posting, paying, deleting); don’t invent data, results or tools I haven’t given you; tell me what you couldn’t verify.
Based on: Jean Manzo — https://x.com/jdevmanzo/status/2107865498230706527

Steps are from the source. Includes a “Based on” credit line.