jclaude

A thin wrapper around Claude Code that runs it inside a bubblewrap sandbox.

The sandbox isolates Claude's filesystem access: it gets a read-only view of system tools, an ephemeral home directory, and write access only to the current working directory and Claude's own state files. Network access is kept so the Anthropic API works normally.

Requirements

• bwrap (bubblewrap)
• Claude Code installed at ~/.local/bin/claude
• openSUSE or a distro with /etc/crypto-policies (TLS requirement)

Usage

jclaude [options] [prompt]

All options are forwarded to claude. One extra flag is handled by the wrapper:

--profile <name>   Use a named profile from ~/.config/jclaude/profiles/<name>/

Profiles isolate Claude's session history, settings, and config. Profile names must match [a-zA-Z0-9_-]+.

Without --profile, the default ~/.claude directory and ~/.claude.json are used.

Extra mounts

By default the sandbox only exposes system tools, Claude's state, and the current working directory. You can grant access to additional paths via mount config files.

Global — applies to every jclaude session:

~/.config/jclaude/jclaudemount

Project-local — applies only when jclaude is launched from that directory:

/your/project/.jclaudemount

Both files use the same format: one path per line, followed by an optional mode (ro or rw). Blank lines and # comments are ignored. ~ is expanded to your home directory. Mode defaults to rw when omitted. Both files are loaded when present; project-local entries are additive on top of global ones.

# read-only access to your notes
~/notes ro

# read-write access to a shared workspace
~/shared/workspace rw

/absolute/path/to/something ro

Paths that do not exist at launch time are skipped with a warning. Language toolchains (Rust, asdf-managed tools, etc.) are not mounted by default — add them here as needed.

Installation

Copy or symlink jclaude somewhere on your $PATH:

ln -s /path/to/jclaude/jclaude ~/.local/bin/jclaude