boks Index
Docs Releases

claude-code

1 tool · 1 release line

Anthropic's agentic coding CLI. Every tool here carries the same sandbox boundary.

boks claude
Source ↗ Registry ↗

Release lines we maintain · the project decides these

findings shown are the whole project at that line

Tag Resolves to Lifecycle Updated Findings What the tag promises
  • stable — floats, carries security updates
  • unstable — tracks pre-releases, may break
  • eol — frozen, upstream is done

Tools in this project · pick one to inspect

all share one boundary

Tool Capabilities Seccomp Findings Image Description
showing claude from claude-code@latest → 2.1.245 stable

Findings

clean

identical on amd64, arm64 — one table describes both

No known findings in this image at the last scan.

These are the findings of claude-code, which ships every tool in this project. boks reports and gates; it never edits an image to clear a finding.

Composition

default + bash, coreutils, curl, diffutils, findutils, gawk, git, grep, gzip, jq, rg, sed, tar, unzip, which
runtime none — self-contained
composes bash, coreutils, curl, diffutils, findutils, gawk, git, grep, gzip, jq, rg, sed, tar, unzip, which

Some tools are only useful composed: a pip-installed CLI needs python as its runtime, bash pulls in coreutils. boks resolves that for you — -e git,python:flake8 composes explicitly.

Image

image ghcr.io/boks-sh/claude-code:2.1.245
digest
platforms
size 392 MB unpacked · 1 layer
base scratch
signed cosign · verified
last scan

Sandbox boundary

claude

capabilities

browsernetrw

Filled is granted to every invocation, outlined to some and not others — see per-subcommand below; the rest need --cap at the point of use.

seccomp tier

per tool

default

The syscall filter applied to this tool's entry point. Tools sharing an image do not share a tier.

dotfiles mapped in

read-only unless noted

  • ~/.claude · writable
  • ~/.claude.json · writable

env passed through

28 forwarded

ANTHROPIC_API_KEYANTHROPIC_AUTH_TOKENANTHROPIC_BASE_URLANTHROPIC_CUSTOM_HEADERSANTHROPIC_MODELCLAUDE_AX_SCREEN_READERCLAUDE_CODE_ACCESSIBILITYCLAUDE_CODE_DISABLE_ALTERNATE_SCREENCLAUDE_CODE_DISABLE_MOUSECLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFICCLAUDE_CODE_OAUTH_TOKENCLAUDE_CODE_SUBAGENT_MODELDISABLE_ERROR_REPORTINGDISABLE_GROWTHBOOKDISABLE_TELEMETRYDO_NOT_TRACKGH_ENTERPRISE_TOKENGH_HOSTGH_TOKENGITHUB_ENTERPRISE_TOKENGITHUB_TOKENHTTPS_PROXYHTTP_PROXYINK_SCREEN_READERNO_PROXYhttp_proxyhttps_proxyno_proxy

Nothing else crosses in. No AWS_*, no SSH_AUTH_SOCK unless you ask.

env set by boks

5 set

CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFICDISABLE_ERROR_REPORTINGDISABLE_GROWTHBOOKDISABLE_TELEMETRYDISABLE_UPDATES

per-subcommand

grants differ

auth + browser
setup-token + browser

Where a tool needs more for one subcommand only, boks scopes it there rather than granting it everywhere. Where it needs less, boks takes it away there too.

Provenance

sbom amd64 ↗ arm64 ↗
attestation amd64 ↗ arm64 ↗
scan report amd64 ↗ arm64 ↗ grype ·
vex amd64 ↗ arm64 ↗

Every image ships a full SBOM and a signed build attestation. Nothing here is a claim you have to take on trust.

0 findings across this project at latest. Counted once per advisory across every image the project builds.