My guideline is nothing can install packages outside of a docker container. For anything on the host, only packages that ship with the default distribution are allowed. This also helps with proper encapsulation of services in a three-tier architecture. Claude always wants to break abstraction layers which leads to 10 different implementations of the same logic in the client besides the increased supply chain risk.

[dead]