In this post, I explain how to use sbx to get a sandboxed version of Claude Code running, including your choice of PHP version and additional tools that you need for your development work. I find sandboxing AI coding agents to be the only sensible thing to avoid these security risks.
For a while, docker sandbox was a good way to go. I found this excellent blog post about setting up sandboxed Claude with PHP back in January/February of this year, and was happy with it until a few weeks ago, when docker sandbox was removed.
In my work context we have containerized dev setups, either custom or using DDEV. In that case it's not a problem to invest in installing Claude Code into the setup, or to use a DDEV plugin.
For my open-source work I need something much more lightweight — I'm potentially in dozens of GitHub repos, researching or changing stuff.
sbx replaces docker sandbox
The replacement is sbx (Docker Sandboxes). It's a bit more involved to set up for my taste, so I wanted to document my learnings here. This is based on their docs, customized for PHP.
One thing worth calling out up front: sbx runs its own microVM, so it gets its own kernel instead of sharing the host's. While I would settle for containers, this is even better for running it in full-autonomy mode. The microVM boundary is enforced by hardware.
Slightly annoying first learning: you need a Docker Hub login to work with sbx.
Installing sbx
I installed it on my Mac:
brew trust docker/tap brew install docker/tap/sbx sbx login
Building a custom template with PHP
Next I build a custom template so the sandbox comes with PHP (and whatever else I need) already installed. I follow build a custom template from their docs. This is the Dockerfile I use:
FROM docker/sandbox-templates:claude-code-nightly # switch to root to install packages USER root RUN apt-get update && apt-get install -y software-properties-common \ && add-apt-repository -y ppa:ondrej/php \ && apt-get update && apt-get install -y \ php8.5 \ php8.5-cli \ php8.5-common \ php8.5-curl \ php8.5-mbstring \ php8.5-mysql \ php8.5-pgsql \ php8.5-sqlite3 \ php8.5-xml \ php8.5-zip \ composer \ && rm -rf /var/lib/apt/lists/* COPY --from=ghcr.io/tideways/cli:latest /usr/bin/tideways /usr/bin/tideways # switch back to the agent user # (this is the default user in the docker/sandbox-templates images) USER agent
It installs PHP 8.5 and the Tideways CLI for AI-Assisted Performance Optimization.
From Docker Image to sbx Template
Now the part that tripped me up. The sandbox doesn't share the image store with your local Docker host, so it can't see an image you just built locally. You have two options: push the image to a registry the sandbox can pull from, or export it to a tar and load it as a template. For lightweight open-source work I go the tar route — no registry needed:
docker build -t beberlei/claude-code-php-8.5:v1 . docker image save beberlei/claude-code-php-8.5:v1 -o beberlei-claude-code-php-8.5.tar sbx template load beberlei-claude-code-php-8.5.tar
Run Sandboxed Claude in a Directory
Now in any directory you can run the sandbox with:
sbx run -t beberlei/claude-code-php-8.5:v1 claude
With sbx template ls you can list all the templates you have available. Remember to rebuild the image every now and then, so you pick up base-image and security updates.
Network Security
Since I only use sbx for open-source work, I keep the setup simple at this step and let the sandbox reach any host:
sbx policy allow network "**"
You can find more restrictive allow rules in the sbx docs.
And that's it!