Claude Code runs in a pinned, checksum-verified image on an internal
network with no egress and a dummy credential. A proxy container is the
only way out: it records every request and swaps in the real credential,
which never enters the Claude Code container. The host's cached feature
flags seed the sandbox config so tools such as Monitor stay available.
--sandbox host keeps the previous in-process mode.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Nicolas Massé