Skip Claude Code’s permission prompts on a computer where a mistake costs little.

What the flag lets Claude Code do

Claude Code normally asks before it runs a command or changes a file, unless you’ve allowed it. The flag turns those questions off for the whole session. That is what lets an agent get through a long job while you’re away.

It also means nothing checks what it does. A wrong command, or instructions hidden in a web page or a file it reads, runs with everything your user can reach:

• Your files, not just the project’s, including ones it could delete.
• Your keys: .env files, ~/.ssh and the sign-ins of your other tools.
• Your Git remotes, so it can push.
• The internet, so what it reads can leave.

Codex has the same switch, --dangerously-bypass-approvals-and-sandbox, or --yolo for short. Everything here applies to it too.

Five places to run it

From the least setup to the most. Each one puts a wall somewhere different.

1. Claude Code’s own sandbox

   Type /sandbox in Claude Code to turn it on. Its commands can then write only in your project, and reach only the sites you allow. It works on a Mac, Linux and WSL2.

   Good when

   You’re at your computer and want fewer prompts, not none.

   What it asks

   It covers commands only. File edits, web fetches and MCP servers run outside it, and commands can still read most of your computer unless you say otherwise. Anthropic says it isn’t enough on its own for a run nobody watches.

2. A dev container

   Run Claude Code in a container set up from your repository. Anthropic publishes an example dev container with a firewall that blocks the sites you haven’t allowed.

   Good when

   You already use Docker or dev containers, and want the setup kept with your code.

   What it asks

   Docker on your computer, and a container and a list of allowed sites to look after. Your project folder is shared with the container, so its changes reach your computer, and a container shares your computer’s kernel: a thinner wall than a virtual machine.

3. Docker Sandboxes

   Docker’s sbx tool runs Claude Code in a small virtual machine of its own, with the flag already on: sbx run claude.

   Good when

   You want a real wall around your agent, on your own computer, in one command.

   What it asks

   A Mac with Apple silicon, Windows 11 or Ubuntu 24.04 or later. Your project folder is shared by default, so changes reach your computer as they happen, and your computer has to stay on.

4. A server you rent

   A Linux server in the cloud with only your project on it. Make an ordinary user, install Claude Code, and run it in tmux.

   Good when

   You want full control, and a computer you can throw away and make again.

   What it asks

   Every part is yours: the user, SSH, a firewall, updates, your tools, getting your project there and signing your agent in.

5. A tile, from TilesOurs

   Your own Linux computer in the cloud, made for coding agents. Only your project and what you choose to bring are on it, and nothing reaches it from the internet: it has no open ports.

   Good when

   You want long runs with no prompts, away from your laptop’s files and keys, without building a server.

   What it asks

   Your project syncs both ways, so what Claude Code does in the project folder reaches your laptop too: push first. The tile can reach the internet, and it’s signed in to your Claude plan and to Tiles, so your agent can use those.

Which one to pick

• At your computer, and you want fewer prompts: Claude Code’s own sandbox.
• No prompts, on your own computer: Docker Sandboxes, or a dev container.
• Long runs with your laptop shut, and nothing to set up: a tile.
• You’d rather build it yourself: rent a server.

Whichever you pick

• Push your work first, so there’s a copy to go back to.
• Bring only the keys the job needs, and ones that can do little: a token for one repository, or a test key, not your main account.
• Limit the sites it can reach where you can, as Claude Code’s sandbox and Anthropic’s dev container do.
• Run it as an ordinary user. Claude Code won’t start with the flag as root on a Mac or Linux.
• Read what changed before you keep it.