Claude needs to not run with sudo permissions

[jrothrock]

1. Claude can turn off iptables
2. It can read the allowlist-proxy private key passed in via -e in docker with sudo cat proc/${pgrep allowlist-proxy}/environ. We can't move the private key to embed, as we just move the goalposts and it will just disassemble the binary. This allows claude to add files to allowed-domain list (we want this) but then can sign the file, overwrite the other one, and sighup the proxy.

Claude might not do these things though even with sudo, as it shouldn't really have any context surrounding this (in normal cases it won't see the .devcontainer / main.go / entrypoint.sh). More obfuscation security but maybe it's fine for now

Removing it requires investigation with DinD on Macos with --privilleged

[jrothrock]

Actually we need to move it to be embeded and remove sudo from claude user (otherwise claude can just disassemble the binary and find the private key). The env var method can be seen with ps aux / is how the environment variable is set in container's init (tini)

[jrothrock]

Meh:
#13

Still needs some thought around it