Menu
中文 GitHub

CLAUDE CODE · DOCKER

Run Claude Code.
Expose less of your machine.

Run Claude Code in Docker through a separate remote node. The goal is to reduce what the tool can access or expose about your real public IP, host system and personal configuration, and reduce related account risk. Codex and other terminal tools can use it too.

Get started GitHub

Network and file isolation · Open source and auditable. See the scope

  • macOS · Linux
  • Windows via WSL2
  • Two containers · Docker required
~/code/myapp Illustrative · documentation IPs 
$ curl -s ipinfo.io/ip
198.51.100.7   ← host: as usual
$ aibox shell
[aibox] 你在 aibox 容器里（网关 mihomo，所有流量经代理）。
[aibox] /workspace/myapp$ curl -s ipinfo.io/ip
203.0.113.24   ← container: node only
[aibox] /workspace/myapp$ claude
    … Claude Code runs in the container (UI omitted) …
AI requests exit through the node · the CLI prints Chinese

WHY AIBOX

Your real IP, system and files.
A boundary for each.

aibox aims to limit Claude Code's direct access to your real machine environment. A remote exit and Linux container reduce exposure; here is what each boundary covers.

01 / FILES

It only sees the folders you pick

Only authorized project folders are mounted. Your personal home and ungranted configuration folders are not mounted. Reference folders can be read-only; project contents remain accessible to the tool.

02 / NETWORK

AI requests use the node's exit IP

Runtime traffic from the workspace goes through your remote proxy or VPN, exposing the node's exit IP to the destination. If it drops, the container goes offline to prevent fallback to your real public IP.

03 / ENVIRONMENT

A separate Linux environment

A container filesystem and separate home volume limit direct access to your host system and personal settings. The kernel, CPU architecture and some resource information remain visible.

Protection scope and information that remains visible
ConcernWhat aibox providesRemaining limits
Real public IPAI requests inside the container exit through a remote node, with DNS protection and a kill switch.Host browser login uses its own network. Your proxy or VPN provider can still see the connection source.
System and machineA separate Linux user space, container home and runtime environment.Hardware features are not fully hidden. Kernel, CPU architecture, resources and aligned UID/GID may remain identifiable.
Files and identityOnly authorized folders are mounted, under /workspace/project paths.Project files, Git metadata and explicitly supplied environment variables may still contain real paths or identity information.
Account restrictionsEgress checks and isolation designed to reduce risk related to environment exposure.Tool telemetry and account identifiers are unchanged. Device unlinkability and protection against bans are not guaranteed.

Initialization, image pulls and builds, subscription preflight and initial downloads, and node hostname bootstrap resolution may use direct host or gateway connections. Environment checks also query the host's IP and DNS from the host. These are outside the proxy path for AI requests inside the container.

PRICING & SERVICES

Plans and services

Use the open-source project for free, or choose a paid service. Sign in with your email before payment, then send that email and your order number to support. Product copy follows the store language, with Chinese as the fallback.

正在读取商城最新商品信息…

自由极客 / 免费

开源自助

¥0/ 永久免费

适合动手能力强、熟悉 Docker 与命令行操作的开发者。

  • 完整 GitHub 开源源码与文档
  • 一键快速安装交互脚本 init
  • 需自备网络节点与 Docker 环境
  • 支持社区 Issue 交流答疑

前往 GitHub 自助

YOU OPERATE / WE GUIDE

1v1 AI environment setup guidance

—Loading current price

A consultant guides one agreed setup task on one device.

  • Guided Docker and aibox setup
  • Connect your own node and check connectivity and DNS
  • First-use guidance and your own account authorization
  • Written setup and usage guide

You operate your device with guidance. Bring your own network resources. Line access and Claude subscriptions are not included.

Loading product
RECOMMENDED

REMOTE DEPLOYMENT / EXCLUSIVE EXIT IP

AI environment deployment and maintenance package

—Loading current price

Remote deployment with line access and original-configuration support. Included periods follow the store.

  • Remote Docker and aibox deployment
  • Configure the exit and project directory permissions
  • An exclusive exit IP for every customer
  • Configuration records, usage guide and acceptance checklist
  • Line access and support periods follow current store terms

Line access starts at usable delivery and notification; support starts at acceptance. Confirm renewal pricing before payment. No automatic charges. Claude subscriptions are sold separately.

Loading product

Optional subscriptions

Claude Pro CDK (support delivery)

After payment, contact support with your signed-in email and order number to receive your CDK and redemption instructions.

—正在读取最新价格
正在读取商品
Benefits and purchase details

    Guidance uses your own network resources. Deployment includes line access with an exclusive exit IP per customer; included periods and renewal pricing follow the store. Subscriptions and CDKs are sold separately. Any payment fee is listed at checkout.

    HOW IT WORKS

    Its own proxy,
    separate from your host.

    Claude Code runs in the workspace container, with networking handled by a separate gateway container (mihomo or a VPN). AI requests inside the container exit through a remote node to reduce exposure of your real public IP. Your host's Clash, VPN and system proxy keep working as usual.

    aibox architecture aibox runs its own proxy in the gateway container, independent of the host's proxy and VPN. On the host, granted folders are mounted read-only or read-write into the workspace container; folders like ~/.ssh that are not granted are invisible. The workspace container has no network interface and drops NET_ADMIN, NET_RAW and SYS_ADMIN. It shares a network namespace with the gateway container, which receives all traffic. The gateway runs mihomo (TUN) or gluetun, with iptables default-deny, DNS resolved through the tunnel and IPv6 disabled. Traffic can only leave through an encrypted tunnel to a remote node or VPN server, then to the internet. Blocked paths: going direct via the physical interface, using a proxy on the host such as Clash as upstream, Docker's built-in DNS 127.0.0.11, and IPv6. HOST · MACOS / LINUX HOST NETWORK UNCHANGED Granted folders ~/code/myapp rw ~/docs/specs ro ~/.ssh not granted ~ or / refused Host proxy / VPN works as usual × not allowed upstream DOCKER · ORBSTACK / DESKTOP / ENGINE SHARED NETWORK NAMESPACE workspace container bash · tmux · git · node · python claude / codex no NIC · drops NET_ADMIN / NET_RAW / SYS_ADMIN /workspace/myapp rw · /workspace/specs ro all traffic gateway container mihomo (TUN) or gluetun (WireGuard / OpenVPN) iptables default DROP, tunnel only DNS → 127.0.0.1, resolved via tunnel IPv6: sysctl off + ip6tables DROP × Docker DNS 127.0.0.11 × IPv6 egress tunnel Remote node / VPN sub · nodes · WireGuard Internet × direct via eth0 (bypassing tunnel)
    Solid: allowed · dashed and ×: blocked · swipe to see the whole diagram
    • Host untouched: the proxy and firewall rules live in the gateway container; none of your host's network settings change, and there's nothing to restore when aibox stops.
    • Container goes only through the node: the AI's container has no network interface of its own; traffic and DNS go through the gateway, IPv6 is off, and bypassing the tunnel is refused by the firewall.
    • No borrowing your local proxy: Clash on your machine has routing rules that may send traffic direct, so it can't be the upstream. Give aibox the subscription URL it uses instead.
    • Boundary: building the images downloads base images and packages over the host network.

    GET STARTED

    Three steps,
    the wizard does the rest.

    You need Docker and a proxy subscription, node links or a WireGuard config.

    1. [1]

      Install Docker

      On macOS use OrbStack or Docker Desktop and start it. On Linux use Docker Engine, then log out and back in once.

      macOS 
      brew install orbstack
      Linux 
      curl -fsSL https://get.docker.com | sudo sh && sudo usermod -aG docker $USER

      Windows: install Docker Desktop with WSL2 integration enabled, then do everything below inside a WSL terminal.

    2. [2]

      Run the setup wizard

      It asks two things: egress (paste a subscription or node links, tested on the spot) and the project folders the AI may use. The first image build takes about 3–5 minutes.

      bash
      git clone https://github.com/seqi781/aibox ~/aibox
cd ~/aibox
./aibox init
      Watch a real recording of ./aibox init (CLI output in Chinese)
    3. [3]

      Start in your project

      Run it inside a project folder. Log in once the first time; after that you stay logged in.

      bash
      cd ~/code/myapp
aibox claude
    • aibox claudeStart Claude Code
    • aibox codexStart Codex
    • aibox shellOpen a shell in the container
    • aibox tmuxKeeps running after you close the terminal; run again to get back
    • aibox statusStatus and exit IP
    • aibox stopStop (data is kept)
    • aibox restartRestart (after changing config)
    • aibox configChange egress and project folders
    • aibox doctorCheck that the isolation works

    Or let an AI set it up: in the aibox folder, ask Claude Code or Codex to “set up aibox for me”. It follows AGENTS.md and asks you for the subscription URL and folders first.

    DOCTOR

    Check the exit and leaks.
    Inspect the isolation.

    aibox doctor tests the exit IP, DNS and tunnel bypass paths, then reports the exit IP's type and risk. Passing covers only the checks performed; it does not establish that Claude Code cannot identify a device or that an account will avoid restrictions.

    aibox doctor --fullExcerpt · illustrative
    出口  egress
  ✔ 容器出口: 203.0.113.24 US AS64500 Example
    宿主机出口: 198.51.100.7
DNS
  ✔ 域名解析由网关接管（fake-ip，真实解析在代理远端完成）
  ✔ 程序硬编码外部 DNS(@8.8.8.8) 也被劫持到网关
隔离  isolation
  ✔ workspace 无 NET_ADMIN / NET_RAW / SYS_ADMIN（root 也改不了网络）
  ✔ 绕过隧道直连物理网卡被防火墙拒绝
断线阻断（模拟隧道断开）  kill switch
  ✔ 隧道断开后流量被完全阻断
  ✔ 隧道恢复后自动重新联网（约 4 秒）

全部通过 … followed by the environment report
    • Tested, not just read: every check sends a real request from the container; any failure means a non-zero exit.
    • Disconnect test: with --full it simulates a tunnel drop, confirms traffic is blocked, then confirms recovery.
    • Environment report: checks exit IP type, risk records, time zone and language. Exit lookups use the proxy; host comparison lookups connect directly, exposing the host IP to those checking services. Redact reports before sharing.
    aibox doctor

    FAQ

    Before you start,
    you might ask.

    Is the goal to prevent bans? Can it fully hide my machine?

    The goal is to reduce Claude Code's access to or exposure of your real public IP, host system and personal environment, and reduce related account risk. aibox provides a separate exit and container isolation, with no guarantee against bans or complete machine fingerprint masking.

    Account identity, usage behavior, exit IP reputation and service rules still affect account status. Tool telemetry, account identifiers and container-visible kernel and hardware information remain.

    Does the browser login also go through aibox?

    Your host browser uses its own network settings; it does not automatically use the container's node. aibox constrains AI requests inside the workspace. Host browsers and other programs need separate network management.

    How does it relate to Clash? Can I just use it?

    They do different jobs: Clash handles your whole machine's browsing, aibox only the AI's egress — you can use both. aibox can't use your local Clash as its upstream; run aibox config and paste the subscription URL Clash uses.

    Which systems are supported?

    macOS (OrbStack recommended; Docker Desktop and Colima also work) and Linux (Docker 25+, Compose 2.24+). Tested on Ubuntu 24.04 arm64 with Docker 29; a physical Mac, SELinux and rootless Docker haven't been tested yet — reports welcome.

    What about Windows?

    Use it inside WSL2: install Docker Desktop with WSL2 integration and work in a WSL terminal, same as Linux.

    What happens if the node goes down?

    The container goes offline; it never falls back to your local network. It reconnects automatically when the node is back.

    Is aibox affiliated with Anthropic or OpenAI?

    No. aibox is an independent open-source project that runs these tools in a container; using them is subject to their own terms.