# Run Claude Code with --dangerously-skip-permissions in an isolated VM

> Let Claude Code or Codex run every command without asking, in a cloud microVM that holds only the repo and key you give it: create the sandbox, copy the project in, run the agent, take the diff out, and delete it, with what it costs.

URL: https://prized.dev/docs/sandboxes-claude-code-skip-permissions
Updated: 2026-10-25

`claude --dangerously-skip-permissions` runs any command without asking, so run it where a bad command can reach only what you put there. A sandbox is that place: a microVM with Claude Code and Codex installed, none of your machine's files or sign-ins, and nothing left of it once you delete it.

* **Its own kernel.** A separate virtual machine, not a container on your laptop; commands run as the user `prized`, without sudo.
* **Only what you copy in.** Your home folder, SSH keys, cloud credentials and other repos stay on your machine.
* **Nothing reaches it from the internet,** and sandboxes have no direct network path to each other.
* **It can reach out.** Outbound internet is open, so the repo and the key you pass can leave it: use a key you can revoke, and no production secrets.

## 1. Create a sandbox with Claude Code in it [#1-create-a-sandbox-with-claude-code-in-it]

[Open Sandboxes](https://prized.dev/onboarding/sandboxes) to sign up with $30 of free credit and no card, and choose **Create API key**. Install the CLI, then export the key in a new terminal:

```bash
curl -fsSL https://prized.dev/install.sh | sh
```

```bash
export PRIZED_API_KEY=dcp_…
```

```bash
ID=$(prized sandbox create --template prized-agent-v1 --env ANTHROPIC_API_KEY="$ANTHROPIC_API_KEY" --max-runtime 1h)
```

Nothing is signed in on the template: pass an Anthropic API key, or with a Claude subscription `CLAUDE_CODE_OAUTH_TOKEN` from `claude setup-token` ([Templates](https://prized.dev/docs/sandboxes#templates)).

## 2. Copy your project in [#2-copy-your-project-in]

```bash
git bundle create /tmp/repo.bundle --all
prized sandbox cp /tmp/repo.bundle $ID:repo.bundle
prized sandbox exec $ID -- git clone -q repo.bundle myproject
```

The bundle carries your commits, not uncommitted changes, and one copy holds up to 100 MB. A public repo can be cloned straight from its URL instead.

## 3. Run Claude Code with no permission prompts [#3-run-claude-code-with-no-permission-prompts]

```bash
prized sandbox exec $ID --cwd myproject --timeout 45m -- 'claude -p --dangerously-skip-permissions "run the tests and fix what fails"'
```

Its answer prints when it finishes. A command runs 5 minutes unless `--timeout` says longer, and the sandbox's hour counts from its create, so leave time for step 4 ([CLI: Sandboxes](https://prized.dev/docs/cli#sandboxes)).

Codex works the same way: create the sandbox with `--env CODEX_API_KEY="$OPENAI_API_KEY"` and run `codex exec --dangerously-bypass-approvals-and-sandbox "…"`.

## 4. Take the changes out and delete it [#4-take-the-changes-out-and-delete-it]

```bash
prized sandbox exec $ID --cwd myproject -- "git add -A && git diff --cached --binary $(git rev-parse HEAD)" > /tmp/fix.patch
git apply /tmp/fix.patch
prized sandbox rm $ID
```

The patch holds every change since your `HEAD`, committed or not, new files included, and with them anything your `.gitignore` misses, such as build output. Deleting the sandbox erases its disk and memory ([Sandboxes](https://prized.dev/docs/sandboxes#automatic-pause-and-delete)).

## What it costs [#what-it-costs]

A running sandbox bills per second; the template's default shape is 4 vCPU and 8 GB, and the free credit caps a sandbox at 2 vCPU and 4 GB ([Billing: Sandboxes](https://prized.dev/docs/billing#sandboxes)).

|  | 2 vCPU, 4 GB | 4 vCPU, 8 GB (the default) |
| --- | --- | --- |
| Running, per hour | $0.131 | $0.261 |
| A 20 minute run | $0.044 | $0.087 |

The model's usage is billed by your Anthropic or OpenAI account. On the free credit, a sandbox runs 60 minutes in all; a top-up or a plan lifts that to 24 hours by default, up to 7 days ([Free tier](https://prized.dev/docs/sandboxes#free-tier)).