luizomf/sannux

Sannux (short for Sandbox Linux) is a collection of Docker templates for running AI coding agents in isolated containers. AI coding agents like Claude Code, Codex, and Gemini's CLI can read files, edit code, run shell commands, and install packages. When you run them directly on your laptop or server, they get the same access your user account has, including SSH keys, cloud credentials, browser configs, and unrelated projects. Sannux addresses this by wrapping each agent in a container and giving it access to only two folders: the project you want it to work on, and a dedicated home directory for that agent's own login tokens and configuration. The project provides nine templates, each pre-configured for a specific tool: Claude Code, Codex, Gemini, Hermes, opencode, Pi, and a remote development server, plus variants that point Claude Code and Codex at locally-running open-source models through Ollama instead of a cloud API. Each template lives in its own folder with a Dockerfile, a Docker Compose configuration, and setup scripts. You can use the whole collection from the repository root using the included justfile task runner, or copy a single template folder to a server and run it with plain Docker Compose. The README is clear about what isolation this does and does not provide. It prevents the agent from accessing your real home directory, reading credentials outside the mounted workspace, or one agent session interfering with another agent's login state. It does not prevent the agent from making network requests, does not protect against compromised container images, and is not a replacement for stronger sandboxing approaches that use virtual machines. The project describes itself as practical isolation for everyday agentic coding workflows rather than maximum-security containment. The templates support interactive terminal sessions, one-shot commands, scheduled unattended runs, and long-running daemon services managed through Compose. CPU and memory resource limits are built into every template. File ownership between the host and container is handled explicitly so files the agent writes in the workspace are owned by your host user, not by root.