An AI coding agent with shell access can read your SSH keys, rm -rf the wrong folder, or quietly phone home with whatever it finds. Before letting Claude Code run more or less unattended, I wanted a real boundary between it and the rest of my Mac — without dragging Docker into it.

The setup

I made a second macOS user, claude-agent, standard privileges only — not in the admin group, no sudo at all. All the code it’s allowed to touch lives in one shared folder, /Users/Shared/code, owned by that user and shared with mine through a dedicated group. Claude Code only ever runs logged in as claude-agent. My own account, my home directory, my browser profiles and secrets, aren’t reachable from there — not because of an app-level promise, but because the filesystem says so. I checked: claude-agent gets a flat Permission denied trying to peek into my home folder.

Why it’s safe enough

This is the same boundary macOS already uses to keep any two people on a shared Mac out of each other’s stuff — it’s kernel-enforced, not something an agent can talk its way around from inside a shell. No sudo means no privilege escalation path. No admin group membership means no touching system files or other accounts. SIP and Gatekeeper stay on exactly as they were. The agent gets a real, if unglamorous, cage: one folder it owns, nothing else.

Why not a devcontainer

Devcontainers are the “correct” answer, and I don’t think that’s wrong — but it’s also a Docker Desktop install, image maintenance, and a layer to keep working for a task I run daily on a machine I already trust. A dedicated OS user costs nothing extra and uses tools I already understand. The honest caveat: it’s still the same kernel, same machine — not a VM boundary, so it’s not a substitute for a real sandbox if you’re running genuinely untrusted code. For an assistant working in my own repos, it’s a proportionate bar, not a fortress.

Turns out I’m not the only one who landed here — Brad Milne and the Infralovers team both wrote up almost the same setup independently. Good sign it’s not a crazy idea.

Sometimes the simplest sandbox is just… another user account.