Containerized
Claude Code, boxed & instrumented.
A Go CLI that launches Claude Code inside a Docker container: egress is default-deny, every run can emit OTLP traces, metrics and logs to the collector you already run, and your organization's existing settings are respected by default. One binary, one container, zero host pollution.
Companion web chat at chat.back2base.net ↗ — browser surface, no container required.
An agent that can run npm install against your home directory is an agent with too much reach. back2base puts Claude Code behind a container boundary: egress is firewalled to the APIs your enabled MCP servers actually need, those servers are pinned to versions you can audit, and the host stays clean — no Node, no Python, no dotfile sprawl from whatever tool the agent reaches for next.
Containment without visibility is just a blind spot you trust. Telemetry is standard OTLP — point it at the collector you already run and Claude Code's traces, metrics and logs land beside the rest of your fleet. It stays off until you turn it on, and it never overrides telemetry configuration you have already set.
$brew install back2base/back2base/back2base
$back2base install
$back2base
Linux packages are built but not yet published to a public apt repo — coming soon.
- 01 Default-deny egress iptables allow-list installed at container start; AWS scoped to published prefixes rather than blanket-allowing eight /8 blocks
- 02 OTLP telemetry traces, metrics and logs to your own collector — opt-in, and it yields to configuration you already set
- 03 MCP servers are yours user-customized and synced per identity, not a fixed list baked into the image
- 04 Org settings respected your organization's existing policy applies by default — back2base fills gaps, it doesn't override
- 05 Prompt cache baked in container image layers ordered for Anthropic's cache TTL
- Docker — macOS today, Linux on the way
- A Claude Pro / Max / Team / Enterprise subscription —
back2base loginauthenticates - ~2 GB disk for the base image on first run