@DanKornas highlighted Clampdown (github.com/89luca89/clampdown), a hardened container sandbox for coding agents: Landlock filesystem rules before the binary starts, deny-by-default egress with an allowlist, real API keys held in a separate auth proxy while the agent gets a dummy key, OCI hooks for nested containers, plus launch helpers for Claude Code, Codex, OpenCode, and pi (GPL-3.0-only).

Key Takeaways

  • ✓Landlock filesystem rules bind the agent to the project directory before start.
  • ✓Real keys stay in an auth proxy; the agent gets a dummy key and deny-by-default egress.
  • ✓Launch helpers for Claude Code, Codex, OpenCode, and pi; GPL-3.0-only.
⚡

Key Decision Metrics at a Glance

TL;DR Verdict
🏆 Benchmark RankRank
No model benchmark in this story · see current rankings
Full Leaderboard→
💰 Cost & PlansCompare
API & Subscription
Compare Plans↗
🛠️ Ecosystem & IDERules
Claude Code (Anthropic)
Setup IDE Rules↗
🧭

Heavy Claude Code use: compare subscription limits and API bills

Compare 40 dev plans & simulate token costs vs $20/mo subscriptions

⚔️ Compare Model→💰 Compare plans & limits↗
Action HubReady to adopt this in production?

Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.

⚔️ Launch VS Compare→💳 View Plans↗
Up NextSymantec finds a grey-market relay that installs the real Codex and Claude Code CLIs, then turns off sandboxing and routes every request through its own servers
Read Now→