Interesting idea. Does the Docker sandbox protect against anything beyond file system changes though? With --dangerously-skip-permissions the agent can still hit external APIs, databases, etc. from inside the container. Curious what the threat model is here.

That's a valid point. The primary protection is file system isolation. The agent can't touch anything outside your project directory, and it won't have destructive access to most external APIs unless you provide keys. The threat model is really about preventing unintended file system changes. Full network sandboxing isn't really viable since Claude Code needs internet access to function.