AI sandbox for Claude and Codex

ai.sh

# To avoid running Claude or Codex in a way that could be considered "dangerous"
#

# Install Ubuntu Noble into a local dir
sudo apt install -y debootstrap systemd-container
sudo debootstrap --variant=minbase noble ~/ai-sandbox-rootfs http://archive.ubuntu.com/ubuntu

# Enter your sandbox and bind-mount your code dir
sudo systemd-nspawn  \
  -D ~/ai-sandbox-rootfs \
  --bind="$HOME/code:/code" \
  --tmpfs=/tmp:mode=1777 \
  --resolv-conf=bind-host \
  /bin/bash
  
  # Install a few things in the sandbox
  apt update
  apt install curl git tzdata coreutils ping host
  
  # Add an unpriviledged user
  useradd -m -s /bin/bash youruser
  
  # Set sane permissions on /tmp
  chmod 1777 /tmp
  
  # Change to user and access your code
  su - youruser
  cd /code
  
  # Install Claude and Codex and Whatever
  # ...