Try It Out

For a quick test, print the version information:

docker run --rm reg.mini.dev/claude-code --version

To run Claude Code against a project, mount the project directory to /workspace (the default command is claude, started in /workspace):

docker run -it --rm \
  -v "$PWD":/workspace \
  -v claude-code-config:/home/node/.claude \
  -v claude-code-bashhistory:/commandhistory \
  reg.mini.dev/claude-code

The claude-code-config volume persists login, settings, and session history across runs, and claude-code-bashhistory persists shell history. Past conversations are keyed to the project path, so mount the same directory at /workspace to --resume them later. For API-key auth instead of the browser sign-in flow, add -e ANTHROPIC_API_KEY=....

1. On the first run, claude starts its sign-in flow and prints a URL — open it in your host browser and authenticate with your claude.ai account.
2. The browser's localhost callback cannot reach into the container, so after authenticating, the claude.ai page shows a code — copy it and paste it at the Paste code here if prompted prompt in the terminal.
3. The token and all settings land in the claude-code-config volume, so every later run mounting that volume starts already signed in.

The image bundles the reference devcontainer's default-deny egress firewall, allowlisting only Anthropic, GitHub, npm, Sentry, and VS Code marketplace endpoints. It's opt-in, and needs both network capabilities to configure iptables:

docker run -it --rm \
  --cap-add NET_ADMIN --cap-add NET_RAW \
  -e CLAUDE_CODE_FIREWALL=true \
  -v "$PWD":/workspace \
  -v claude-code-config:/home/node/.claude \
  reg.mini.dev/claude-code

A firewall failure aborts the container rather than starting unprotected (fail-closed).

Run Claude Code without pausing for approval on each step using the --dangerously-skip-permissions flag . Pair it with the firewall above to further limit the blast radius. Inside the container there are no SSH keys, cloud credentials, browser data, or other repositories to reach, only the directory you mount:

docker run -it --rm \
  --cap-add NET_ADMIN --cap-add NET_RAW \
  -e CLAUDE_CODE_FIREWALL=true \
  -v "$PWD":/workspace \
  -v claude-code-config:/home/node/.claude \
  reg.mini.dev/claude-code claude --dangerously-skip-permissions

Never mount /var/run/docker.sock into this container — that grants host root.

Any other command passes straight through the entrypoint, so the image also works as a dev shell or to check a bundled tool's version.

For example, check the node version:

docker run --rm reg.mini.dev/claude-code node --version

Technical Considerations

The Claude Code image provided by Minimus is a slim, security-hardened alternative to the official reference devcontainer published by Anthropic. The images are functionally interchangeable, with a few differences as noted below.

1. This is a prebuilt registry image based on the Dockerfile distributed by Anthropic as a reference devcontainer for building on a Debian/node:20 base, assembled by a devcontainer-aware editor.
2. Ships on a current, non-EOL Node.js runtime rather than the reference container's Node 20/Debian bookworm base, which is EOL as of April 2026. This substantially reduces the base image's CVE surface.
3. Installs the Claude Code CLI as a GPG-verified, package-managed binary rather than through npm, so CLI updates track image updates automatically.
4. Carries a one-line fix to the reference's egress-firewall script so a single domain's DNS failure skips that domain instead of aborting the whole firewall.
5. Drill down on the version specification tab to see the default user, entrypoint, volumes, and environment variables.

A hardened, minimal image that will remain more secure for the long run and accrue vulnerabilities at a slower rate.

• See the risk reduction dashboard for a detailed CVE comparison over the past 30 days.
• Review the compliance report to see the default hardening and security configurations for the image.

Terms & Info

This catalog is published by Minimus. All product names, logos, and marks, other than those belonging to Minimus, shown are owned by their respective rights holders and appear here only to identify the open source software each image contains. Minimus claims no ownership of those marks and implies no affiliation with, endorsement by, certification by, or sponsorship by any rights holder.

Images are provided "as-is" without warranty of any kind. "Hardened" refers to the security configuration applied at the time of build and does not constitute a guarantee of ongoing security or absence of vulnerabilities. The free tier is provided without support, SLA, or guaranteed patching timelines. Security updates may be applied to paid subscriptions before or instead of free tier images. By pulling or using any image you agree to our Terms of Use.