Guides

Run claude --dangerously-skip-permissions in a microVM

With the --dangerously-skip-permissions flag, Claude Code acts without asking first. Anthropic says to use it only in an isolated container or VM. Brig runs it in a microVM on Mac or Linux.

brig run claude ~/code/demo -- --dangerously-skip-permissions

Brig sends every argument after -- to Claude Code unchanged. The agent works in ~/code/demo, and the rest of your machine is out of its reach.

The Brig project wrote this page. Anthropic has not reviewed or endorsed it.

What the flag does #

The flag starts Claude Code in bypassPermissions mode. In this mode, Claude edits files, runs shell commands and reaches the network without a prompt. Anthropic's documentation lists the mode for "isolated containers and VMs only", and says it "offers no protection against prompt injection or unintended actions". It is also known as YOLO mode.

Some checks stay on in this mode:

Everything else runs at once.

Why a microVM #

Coding agents install packages, run commands and use credentials. With no prompt, you do not see a command before it runs. Without a sandbox, Claude Code runs as your user, so a command can reach what your account can reach.

Under Brig, the same command runs inside a machine of its own:

• Its own kernel. Each sandbox is a microVM with its own Linux kernel, behind a hardware boundary.
• One project. Brig mounts the project you name, read-write at /work/<name>, and a guest home for the agent's settings. Nothing else from your machine is mounted. Your keychain and your SSH agent stay out of reach.
• No credentials by default. A sandbox starts with none. You deliver the ones the agent needs. See Secrets.
• The network you allow. An egress policy limits the sandbox to the hosts and ranges you name. Brig enforces it outside the guest, at a gateway on macOS and in nftables on Linux.
• A clean start. brig rm removes the sandbox. Your project stays where it is.

Security model states each boundary and its limits.

Run Claude Code with the flag #

Install Brig and check the host. A !! line prints its fix beside it. See Install.

brig doctor

To limit the network, attach a policy with a route before the run. The route keeps your Claude Code login on your machine, renews it there, and gives the sandbox a session token in its place. With default: deny, the sandbox reaches nothing else:

apiVersion: brig.sh/v1alpha1
kind: Policy
metadata:
  name: claude-only
  description: Claude Code through the broker, and no other egress
spec:
  egress:
    default: deny
  routes:
    - name: anthropic
      preset: claude-code
      credential:
        secretRef: { name: claude-credentials }

Store your login, then create the policy and attach it:

brig secret import claude-code    # stores your Claude Code login as claude-credentials
brig policy create claude-only    # opens the starter in your editor
brig policy attach claude-only claude

Credential broker covers routes.

Then start Claude Code with the flag:

mkdir -p ~/code/demo
brig run claude ~/code/demo -- --dangerously-skip-permissions

With no route and no stored login, Claude Code asks you to log in inside the sandbox on the first run. That login, and each renewal of it, goes to platform.claude.com, so a policy that allows only api.anthropic.com blocks it.

The first interactive session with this mode shows Anthropic's warning dialog. If you accept it, Claude Code saves the answer in its user settings. Under Brig, that file is ~/.brig/homes/brig-claude-code/.claude/settings.json on the host, which the agent reads at /brig/claude/settings.json. The dialog does not return when the sandbox restarts. brig rm deletes the guest home and the file with it.

The root check #

On Linux and macOS, Claude Code refuses this flag when it runs as root:

--dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons

Anthropic's documentation says the check is skipped inside a recognized sandbox. Brig's Claude Code guest runs as root, and the built-in profile sets IS_SANDBOX=1. With it set, the flag runs. Without it, Claude Code refuses the flag. Built-in profiles prints the profile.

Anthropic's table of setups names a non-root user for this flag. Under Brig, the microVM is the boundary. On a rootless Linux install, root in the guest maps to your own user on the host.

What it can still reach #

Without prompts, the agent still has everything you gave the sandbox:

• The agent edits the real files in the project, so its work lands in your project.
• The agent can send what it reads over the network. To limit where, attach an egress policy.
• The agent can use every credential you deliver to it.

Auto mode #

Auto mode keeps a check without a prompt. In Anthropic's words, a second model, the classifier, "reviews actions instead of you". To use auto mode under Brig, run:

brig run claude ~/code/demo -- --permission-mode auto

Both modes run in the same microVM. The permission mode decides which actions Claude asks about. Brig decides what an action can reach once it runs.

Agent sandboxes covers Claude Code's own Bash sandbox, and Docker covers dev containers.

Sources #

Read on 2026-11-04.

• Choose a permission mode, Claude Code documentation: the modes, bypassPermissions, and the root check.
• Development containers, Claude Code documentation: running without permission prompts in a container.
• Configure the sandboxed Bash tool, Claude Code documentation.
• The Claude Code profile in brig: IS_SANDBOX and the guest account.
• The facts about Brig come from Security, Networking, Command line, Built-in profiles and Brig and the CVP practices on this site.