Sign in

Run Claude Code with --dangerously-skip-permissions in an isolated VM

Let Claude Code or Codex run every command without asking, in a cloud microVM that holds only the repo and key you give it: create the sandbox, copy the project in, run the agent, take the diff out, and delete it, with what it costs.

On this page5

claude --dangerously-skip-permissions runs any command without asking, so run it where a bad command can reach only what you put there. A sandbox is that place: a microVM with Claude Code and Codex installed, none of your machine's files or sign-ins, and nothing left of it once you delete it.

  • Its own kernel. A separate virtual machine, not a container on your laptop; commands run as the user prized, without sudo.
  • Only what you copy in. Your home folder, SSH keys, cloud credentials and other repos stay on your machine.
  • Nothing reaches it from the internet, and sandboxes have no direct network path to each other.
  • It can reach out. Outbound internet is open, so the repo and the key you pass can leave it: use a key you can revoke, and no production secrets.

1. Create a sandbox with Claude Code in it

Open Sandboxes to sign up with $30 of free credit and no card, and choose Create API key. Install the CLI, then export the key in a new terminal:

curl -fsSL https://prized.dev/install.sh | sh
export PRIZED_API_KEY=dcp_…
ID=$(prized sandbox create --template prized-agent-v1 --env ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" --max-runtime 1h)

Nothing is signed in on the template: pass an Anthropic API key, or with a Claude subscription CLAUDE_CODE_OAUTH_TOKEN from claude setup-token (Templates).

2. Copy your project in

git bundle create /tmp/repo.bundle --all
prized sandbox cp /tmp/repo.bundle $ID:repo.bundle
prized sandbox exec $ID -- git clone -q repo.bundle myproject

The bundle carries your commits, not uncommitted changes, and one copy holds up to 100 MB. A public repo can be cloned straight from its URL instead.

3. Run Claude Code with no permission prompts

prized sandbox exec $ID --cwd myproject --timeout 45m -- 'claude -p --dangerously-skip-permissions "run the tests and fix what fails"'

Its answer prints when it finishes. A command runs 5 minutes unless --timeout says longer, and the sandbox's hour counts from its create, so leave time for step 4 (CLI: Sandboxes).

Codex works the same way: create the sandbox with --env CODEX_API_KEY="$OPENAI_API_KEY" and run codex exec --dangerously-bypass-approvals-and-sandbox "…".

4. Take the changes out and delete it

prized sandbox exec $ID --cwd myproject -- "git add -A && git diff --cached --binary $(git rev-parse HEAD)" > /tmp/fix.patch
git apply /tmp/fix.patch
prized sandbox rm $ID

The patch holds every change since your HEAD, committed or not, new files included, and with them anything your .gitignore misses, such as build output. Deleting the sandbox erases its disk and memory (Sandboxes).

What it costs

A running sandbox bills per second; the template's default shape is 4 vCPU and 8 GB, and the free credit caps a sandbox at 2 vCPU and 4 GB (Billing: Sandboxes).

2 vCPU, 4 GB4 vCPU, 8 GB (the default)
Running, per hour$0.131$0.261
A 20 minute run$0.044$0.087

The model's usage is billed by your Anthropic or OpenAI account. On the free credit, a sandbox runs 60 minutes in all; a top-up or a plan lifts that to 24 hours by default, up to 7 days (Free tier).