Oxidising the sandbox

Porting the claude-container runner to Rust

In the previous section I mentioned hesitance to go through the rigmarole of porting the shell script to Rust, but at some point the next day I realised this could just be a good little experiment for Claude.

Beam me up Claudey

I was trying out the “teleport” feature, wondering how exactly that works when you have mounts etc., and ended up using this as a straightforward test of the setup. At the time of writing I had to run this with --unrestricted-network for it to work. Lo and behold, 30 minutes or so later Claude had fully ported the shell script setup to jdx’s new usage-rs framework.

In fact, since my default Claude Code cloud environment had internet access off, but GitHub’s API was working, and Claude was trained on the web so knew the repo URLs already, it just pulled down the required repos and built the entire dependency tree from source. This seems to have meant it didn’t need to go reading docs either, and soon enough it had finished the port.

This is a perfect example of how agents behave when they encounter a network blocker. It seems likely to me that this should be considered a form of misuse; my expectation would have been that the GitHub access was only to be used for the repo that was connected, not as a general access route. In other words, I would have expected the agent to have been unable to complete the task, but was pleasantly surprised when it was. In this case it was a benign, productive sort of surprise, but generally not having clear controls nor ability to intuit this sort of behaviour is undesirable.

I then resumed the session and subsequently lost the ephemeral cloud container, but simply… asked Claude (which had retained the session turn history) to recreate the files. A weird form of file copying, with the same ultimate outcome of a nicely compiled portable binary that I could simply install locally rather than put a shell script on my path. The agent transcript functions a kind of backup when working on an ephemeral filesystem.

Obviously this entailed doing a bunch of things in the script more professionally, but overall we are just looking at a more easily explorable form of the same program.