I would also like to add a list of allowed site, closing all the others, but it is quite complex from docker.
It is not safe like a isolated VM, but it is a good trade-off to avoid letting a model to wipe out all your home directory or looking into other files in your disk.
As always feedback is wellcomed
since my employer is compelling me to throw out my expertise and rot my brain with Claude, I've been using clawk to sandbox instances in VMs: https://github.com/clawkwork/clawk
It's not perfect, but it works pretty well, and has done a nice job of forcing me to think through exactly what I'm allowing Claude access to and why, and what the risks are.
Maybe use two containers in the same docker network. One docker container has the agent and is not allowed to leave the network. The other container you'd run a proxy in with whitelisting and that container is allowed to leave the network.