A new open-source project called sclaude is gaining traction on Hacker News as a lightweight bash script that wraps Anthropic's Claude CLI and OpenAI's Codex CLI in a local Docker sandbox. Posted on September 15, 2026, the tool offers developers a drop-in replacement for native CLI execution, addressing growing concerns about local file system safety during AI agent operations.

The Catalyst Behind the Resurrection

The project's creator, identified on GitHub as e6qu, revealed that the script had been sitting in a dormant state for some time. The impetus for its revival was a specific degradation in user experience with Anthropic's 'auto mode.' The developer noted that the feature was 'not working as automatically as before,' forcing users to manually approve actions or risk unintended file modifications. This friction pushed the developer back to a hard isolation boundary.

How the Sandbox Works

sclaude operates by mounting the current working directory into a Docker container and executing the AI CLI within that isolated environment. The usage is deliberately minimal: developers invoke sclaude or scodex instead of claude or codex. This design choice means the AI agent can read and write files, but its blast radius is strictly contained to the mounted volume. If the agent hallucinates a rm -rf, it happens inside the container, not on the host machine's root.

Why This Matters for Agentic Workflows

As LLMs transition from chatbots to autonomous agents capable of executing shell commands, the attack surface for local environments has expanded exponentially. While major vendors push cloud-based sandboxes, sclaude represents a grassroots counter-movement: local, transparent, and containerized. It appeals to developers who need the speed of local execution without the anxiety of an AI agent having unrestricted sudo-like access to their personal machine.

Key Takeaways

  • sclaude provides a Docker-based isolation layer for both Claude and Codex CLI.
  • The project was revived specifically due to reliability issues with Claude's 'auto mode'.
  • Usage is a direct alias replacement: run sclaude instead of claude.
  • The tool mitigates the risk of destructive file system changes by agents.

The Bottom Line

sclaude proves that when vendor-managed safety rails fail, developers will build their own. The friction of Docker is a small price to pay compared to the friction of manually approving every file write in auto mode.