{"id":50729605,"url":"https://github.com/tnfru/autobox","last_synced_at":"2026-06-10T07:03:50.599Z","repository":{"id":311474674,"uuid":"1043808319","full_name":"tnfru/autobox","owner":"tnfru","description":"Sandbox Claude Instance without exposing Git","archived":false,"fork":false,"pushed_at":"2026-05-22T12:20:56.000Z","size":144,"stargazers_count":3,"open_issues_count":1,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-05-22T17:54:20.420Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tnfru.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-08-24T17:00:36.000Z","updated_at":"2026-05-22T12:18:09.000Z","dependencies_parsed_at":null,"dependency_job_id":"3a8bba1f-9182-4417-af4a-3b5758d83d1f","html_url":"https://github.com/tnfru/autobox","commit_stats":null,"previous_names":["tnfru/claude-nogit","tnfru/autobox"],"tags_count":2,"template":false,"template_full_name":null,"purl":"pkg:github/tnfru/autobox","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tnfru%2Fautobox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tnfru%2Fautobox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tnfru%2Fautobox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tnfru%2Fautobox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tnfru","download_url":"https://codeload.github.com/tnfru/autobox/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tnfru%2Fautobox/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34140776,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-10T02:00:07.152Z","response_time":89,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-10T07:03:50.316Z","updated_at":"2026-06-10T07:03:50.584Z","avatar_url":"https://github.com/tnfru.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# autobox\n\n### Run multiple Claude agents in parallel. Keep your git history safe.\n\n[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)\n[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](http://makeapullrequest.com)\n[![Docker](https://img.shields.io/badge/Docker-required-blue?logo=docker\u0026logoColor=white)](https://www.docker.com/)\n[![Claude Code](https://img.shields.io/badge/Claude_Code-required-blueviolet)](https://claude.ai/download)\n\n`--dangerously-skip-permissions` without the danger. Each agent runs in its own Docker container on a separate git worktree. Your `.git` is hidden behind a tmpfs — Claude gets full autonomy but can't touch your history, force-push, or delete branches. Spawn agents, attach to any of them, detach, come back later.\n\nhttps://github.com/user-attachments/assets/565bf780-cf2d-4c16-a1b7-c471733a24de\n\n## Quick Start\n\n```bash\n# Install\ncurl -sSL https://raw.githubusercontent.com/tnfru/autobox/master/install.sh | bash\n\n# Launch the agent manager\nautobox agents\n```\n\nType a task, hit Enter. The agent spawns in the background. Select it and press Enter to attach. `Ctrl-Q` to detach — the agent keeps working. Repeat.\n\n```bash\n# Or run a single agent directly\nautobox -- -p \"fix all failing tests\"\n```\n\n**Requires:** [Docker](https://www.docker.com/) and [Claude Code](https://claude.ai/download)\n\n## How It Works\n\n```\n  ┌──────────────────────────────────────────────────────────┐\n  │  autobox agents (TUI)                                    │\n  │                                                          │\n  │  ┌─────────────────┐  ┌─────────────────┐               │\n  │  │ fix-auth   ● run│  │ add-tests  ● run│  ...          │\n  │  │ agent/fix-auth   │  │ agent/add-tests │               │\n  │  └────────┬────────┘  └────────┬────────┘               │\n  │           │                    │                          │\n  └───────────┼────────────────────┼──────────────────────────┘\n              │                    │\n              ▼                    ▼\n  ┌──────────────────┐  ┌──────────────────┐\n  │  Docker container │  │  Docker container │\n  │                   │  │                   │\n  │  Claude Code      │  │  Claude Code      │\n  │  --skip-perms     │  │  --skip-perms     │\n  │                   │  │                   │\n  │  /workspace ──────│──│── git worktree    │\n  │  .git = tmpfs     │  │  .git = tmpfs     │\n  └──────────────────┘  └──────────────────┘\n```\n\nEach agent gets:\n\n1. **A git worktree** on a new branch — instant checkout, no file copying\n2. **A Docker container** with `.git` hidden behind a tmpfs\n3. **Full autonomy** — `--dangerously-skip-permissions` with Docker access proxied for safety\n4. **Its own session** — conversations persist across attach/detach\n\nWhen you're done, changes are already on disk. Review the branch, merge or discard.\n\n## Agent Manager\n\n`autobox agents` launches a TUI for managing multiple agents:\n\n| Key | Action |\n|-----|--------|\n| Type + Enter | Start a new agent with that task |\n| ↑/↓ or j/k | Navigate the agent list |\n| Enter | Attach to a running agent |\n| Ctrl-Q | Detach from agent (container keeps running) |\n| Enter | Open completed agent's worktree in Claude (normal permissions) |\n| /exit | Return from worktree session to TUI |\n| d | Delete an agent (confirms if running or dirty) |\n| t | Toggle dark/light theme |\n| q | Quit |\n\nAgents are grouped into **Working** (running containers) and **Completed** (finished, with file changes or clean). Desktop notifications fire when an agent finishes.\n\n## What's Protected\n\n| Threat | Protection |\n|--------|------------|\n| `git push --force` | `.git` hidden behind tmpfs — no remote access |\n| `git reset --hard` | No real git history in the container |\n| Rewrite commits | No commits to rewrite |\n| Delete branches | No branches accessible |\n| Exfiltrate code | Optional firewall restricts to Anthropic, GitHub, npm, PyPI |\n| Escape via Docker | Socket proxy blocks privileged mode, host namespaces, out-of-workspace mounts |\n| Modify files outside project | Container filesystem isolation |\n\n## Installation\n\n```bash\ncurl -sSL https://raw.githubusercontent.com/tnfru/autobox/master/install.sh | bash\n```\n\n\u003cdetails\u003e\n\u003csummary\u003eManual install\u003c/summary\u003e\n\n```bash\ngit clone https://github.com/tnfru/autobox.git\ncd autobox\ncp autobox ~/.local/bin/\npip install -e .  # for the TUI (autobox agents)\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003eFrom source (development)\u003c/summary\u003e\n\n```bash\ngit clone https://github.com/tnfru/autobox.git\ncd autobox\nuv pip install -e .\ncp autobox ~/.local/bin/\n```\n\n\u003c/details\u003e\n\n## Options\n\n| Flag | Description |\n|------|-------------|\n| `--name NAME` | Name the agent/worktree (default: derived from task) |\n| `--worktree PATH` | Re-enter an existing worktree instead of creating one |\n| `--detach` | Start container in background (used by TUI) |\n| `--firewall` | Restrict outbound traffic to Anthropic, GitHub, npm, PyPI |\n| `--no-firewall` | (default) Unrestricted network |\n| `--docker` | (default) Mount Docker socket via security proxy |\n| `--no-docker` | Don't mount Docker socket |\n| `--network NAME` | Connect to a Docker network (e.g. for databases) |\n| `--continue` | After container exits, resume session on host with normal permissions |\n| `--no-continue` | (default) Drop into worktree shell without resuming |\n| `--full` | Include `node_modules`, `.venv` in the worktree |\n| `--rebuild` | Force Docker image rebuild |\n| `--purge-sessions` | Delete saved session data for the project |\n| `-- [args]` | Pass remaining arguments to Claude |\n\n## Standalone Usage\n\nDon't need the TUI? Run a single agent directly:\n\n```bash\n# Current directory\nautobox\n\n# Specific project\nautobox /path/to/project\n\n# Give Claude a task\nautobox -- -p \"refactor the auth module\"\n\n# Resume a previous conversation\nautobox -- --resume\n\n# With network firewall\nautobox --firewall\n\n# Connect to a local database\nautobox --network my-network\n```\n\nWhen the container exits, you land in the worktree to review changes.\n\n## How It Compares\n\n| | autobox | Bare `--dangerously-skip-permissions` | Process sandboxes |\n|---|---------|---------------------------------------|-------------------|\n| **Git safety** | `.git` hidden behind tmpfs | `.git` fully writable | `.git` writable |\n| **Parallel agents** | TUI manages multiple agents | Manual terminal juggling | N/A |\n| **Network control** | Firewall allowlist | Unrestricted | Varies |\n| **Blast radius** | Container only | Entire system | Project directory |\n| **Session continuity** | Attach/detach, persists | N/A | Native |\n\n## Architecture\n\n```\nautobox (bash)               Entry point — arg parsing, worktree, Docker orchestration\nautobox agents (Python/TUI)  Agent manager — spawn, attach, detach, cleanup\ndevcontainer/\n  Dockerfile                 debian:bookworm-slim + native Claude binary (~591MB)\n  entrypoint.sh              Firewall init + throwaway git init on tmpfs\n  init-firewall.sh           iptables/ipset rules for allowlisted domains\n  docker-proxy.py            Docker socket proxy — blocks privileged containers, restricts mounts\n```\n\n## FAQ\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eWhy not just use Anthropic's devcontainer?\u003c/strong\u003e\u003c/summary\u003e\n\nThe official devcontainer mounts your full project directory including `.git`. autobox exists specifically to prevent that — your git history never enters the container.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eDoes this limit what Claude can do?\u003c/strong\u003e\u003c/summary\u003e\n\nNo. Claude has full `--dangerously-skip-permissions` inside the container. It can edit files, run commands, install packages — it just can't touch your git history or escape the container.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eWhat about Docker-in-Docker?\u003c/strong\u003e\u003c/summary\u003e\n\nBy default, the host Docker socket is mounted so Claude can spin up sibling containers. A proxy (`docker-proxy.py`) sits between Claude's Docker CLI and the real daemon, blocking privileged mode, host PID namespace, `SYS_ADMIN` capabilities, device mounts, and bind mounts outside the workspace. Pass `--no-docker` to disable the socket mount entirely.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eWhat about .env files?\u003c/strong\u003e\u003c/summary\u003e\n\nThe worktree only contains git-tracked files. Untracked files like `.env` won't be present unless you add them manually. Use `--full` to copy dependency directories.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eWhat does the firewall allow?\u003c/strong\u003e\u003c/summary\u003e\n\nAnthropic API, GitHub (IPs from their `/meta` endpoint), npm, PyPI, and Sentry/Statsig (Claude telemetry). Everything else is blocked via `iptables`. IPv6 is rejected entirely.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n\u003csummary\u003e\u003cstrong\u003eHow do I clean up worktrees?\u003c/strong\u003e\u003c/summary\u003e\n\nThe TUI handles cleanup automatically. For manual cleanup:\n\n```bash\ngit worktree list                          # see all worktrees\ngit worktree remove .claude/worktrees/NAME # remove one\n```\n\u003c/details\u003e\n\n## Contributing\n\nPRs welcome. See [CLAUDE.md](CLAUDE.md) for development notes.\n\n## License\n\n[MIT](https://opensource.org/licenses/MIT)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftnfru%2Fautobox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftnfru%2Fautobox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftnfru%2Fautobox/lists"}