Claude Code in a Docker sandbox — bundled (SSH) & developer (standalone)
AI Terminal
What is AI Terminal
Claude Code CLI running in an isolated Docker container, exposed via a browser terminal (xterm.js). You type natural language, Claude executes commands (edit files, git, ssh, curl) inside the sandbox.
Two modes
Bundled = for XessOne clients with a VPS; per-session SSH key injected automatically. Developer (standalone) = instant access with no VPS, workspace persistent on a Docker volume.
Developer Mode Quickstart
- 1Sign up at app.xessone.com (or log in).
- 2Top up XESS AI balance, minimum Rp 10,000 via AI → Top Up.
- 3Open /dashboard/ai-terminal.
- 4Click 'Start Developer Session' — the terminal modal opens in 3-5 seconds.
- 5Type `claude` to start a Claude Code session.
Bundled Mode Quickstart
- 1Must have a VPS registered at /dashboard/vps.
- 2Submit an access request at /dashboard/ai-terminal (form below the balance card).
- 3Admin reviews and approves with a window (1 day / 7 days / 30 days / one-shot).
- 4Once approved, the 'Open Terminal' button activates.
- 5Inside the session you can `ssh root@<vps-ip>` directly — the SSH key is auto-injected and revoked when the session ends.
Egress Allowlist
Every container has a default-DROP iptables policy. Only the hosts below are reachable:
Developer Mode
- api.anthropic.com — Claude API via the XessOne gateway
- app.xessone.com — XessOne API gateway
- github.com, api.github.com, codeload.github.com, raw.githubusercontent.com, objects.githubusercontent.com
- registry.npmjs.org — npm install
- pypi.org, files.pythonhosted.org — pip install
Bundled Mode
- api.anthropic.com + app.xessone.com
- Your own VPS IPs (from vps_instances) on ports 22, 80, 443
Hard egress block
curl to a domain outside the allowlist will timeout/refuse. By design — the sandbox must not `curl attacker.com` even under prompt injection.
Limits & Security
- Max 3 concurrent sessions system-wide.
- Max 1 session per user at a time.
- Idle 15 minutes with no activity → container destroyed automatically.
- 1 GB RAM, 1 vCPU, up to 256 PIDs per container.
- Linux capabilities drop-all except NET_ADMIN + CHOWN/SETUID for bootstrap.
- Per-session SSH key (bundled) — revoked when the session ends.
- Docker volume workspace (developer) — persists across sessions, cleaned up on request.
Pricing
Pay-per-token via XESS AI balance. No subscription or setup fee. Rates (after XessOne markup):
- Haiku 4.5: Rp 21 input / Rp 105 output per 1k tokens — thrifty for autocomplete & small refactors.
- Sonnet 4.6 (default): Rp 62 / Rp 310 per 1k — daily coding.
- Opus 4.7: Rp 312 / Rp 1,560 per 1k — agentic tasks, deep refactor.
A Rp 50,000 balance covers roughly 800k Sonnet tokens (hundreds of practical prompts).
Troubleshooting
- "Insufficient XESS AI balance" → top up via /dashboard/ai.
- "No VPS instances registered" (bundled) → register a VPS at /dashboard/vps first.
- "Session already running" → check /dashboard/ai-terminal, click End Session or wait for idle timeout.
- Claude error 402 → balance ran out mid-session, top up and rerun.
- curl to an outside domain fails → egress allowlist (by design), see section above.
FAQ
Why does bundled mode need admin approval?
Because Claude will SSH into your VPS with root access. Admin review prevents abuse and leaves an audit trail for compliance.
Can I use a GPU or a different model?
Only Claude for now (Sonnet 4.6 default, Opus 4.7 on-demand). Vultr Serverless Inference (DeepSeek, Qwen) is deferred until volume justifies it.
Is my data safe?
Container destroyed at session end. Developer mode: workspace lives in an XessOne-owned Docker volume (you can request deletion). Bundled mode: per-session SSH key, revoked afterward. Prompts relay to Anthropic via the XessOne gateway — content is not logged beyond billing metadata.
