I would like a simple tool to run Claude in a container with only read/write access to provided folders.

I’ve set it up bespoke but the auth flow gets broken.

I use the .devcontainer¹ from the claude-code repository. It works great with VSC and let's you work in your docker container without any issues. And as long as you use some sort of version control (git) you cannot really lose anything.

¹ https://github.com/anthropics/claude-code/tree/main/.devcont...

This is the main problem with all the AI stuff, you really need: whitelist only network isolation, idempotent clean virtual machine creation and cleanup, automated git branches and merging strategies, full chain multi host logging to an external log collector (when something unexpected happens to should be able to review an entire event log of where it went wrong so you can improve), social-graph like tracking of what works and what doesn't, constant background model testing (to detect when censorship is going to bite you) or when a new better model for quality for cost effectiveness can be swapped in, anything background like agents needs an orchestrator so you can set up daily or weekly budgets to try and keep a handle on costs, some defined methodology to reduce long running agent based production down to actual reliable code on an ongoing basis

The tooling required for any of this to approach actual engineering reliability levels is unbelievable really

Claudebox is what I was playing with. You need to mount the oauth access token in as an env. It’s not some crazy vibe coded framework, just around 1k lines of shell helpers to set it up.

Have you considered asking Claude code to write this for you?