HolyClaude runs AI coding agents inside a Docker container with elevated capabilities. This document explains the security model, what the container can access, and how to report vulnerabilities.

HolyClaude keeps the following browser-container defaults in the compose files:

These are the current compose defaults for HolyClaude's browser profile. SYS_ADMIN and seccomp=unconfined broaden process privileges and reduce isolation, and SYS_PTRACE is debugging-related. Use them only for trusted workloads, and treat any hardening pass as a separate change.

/dev/shm exhaustion and an immediate SIGTRAP or exit 133 are separate failure modes. Treat them separately when you troubleshoot browser launches.

The default acceptEdits mode is right for most users. bypassPermissions is documented for power users who understand the implications.

Codex support uses configurable near-parity modes, not identical security. The current CloudCLI browser client sends permissionMode explicitly. HOLYCLAUDE_CODEX_CHAT_PERMISSION_MODE is only a fallback for requests that omit it, and an explicit request value wins. HOLYCLAUDE_CODEX_CLI_PERMISSION_MODE only seeds a new raw codex CLI ~/.codex/config.toml on first boot; its default is default. Valid values are default, acceptEdits, and bypassPermissions.

Pi Coding Agent runs with the same container user permissions as the pi process that launches it. HolyClaude does not add a separate Pi permission gate, so use it in trusted workspaces and keep the container boundary in mind.

Do not expose CloudCLI directly to the public internet, especially with any bypass mode enabled. Docker limits access to the container and mounted volumes, but CloudCLI still exposes an interactive coding environment with credentials and mounted workspace files.

HolyClaude includes sshd and Mosh in both image variants, but the server path is disabled by default. sshd is only added to the s6 service bundle when HOLYCLAUDE_SSH_ENABLE=true and startup finds a safe public-key file mounted outside /home/claude/.claude, /home/claude, and /workspace.

SSH is key-only:

• PermitRootLogin no
• PasswordAuthentication no
• KbdInteractiveAuthentication no
• AllowUsers claude
• no X11, TCP forwarding, agent forwarding, or tunnel forwarding by default

The public-key source should be a separate read-only mount such as /run/holyclaude-ssh/authorized_keys. Do not store authorized_keys in .claude; that directory also stores credentials and agent runtime state.

Mosh is not a daemon. The mosh-server wrapper only runs when HOLYCLAUDE_MOSH_ENABLE=true, and it uses the configured UDP range. Keep SSH and Mosh ports behind localhost, VPN, Tailscale, or firewall allowlists.

HolyClaude vendors @cloudcli-ai/cloudcli and applies Docker-build patches to the source and compiled runtime files. Do not replace CloudCLI from inside a running container with cloudcli update or npm install -g @cloudcli-ai/cloudcli@latest; update HolyClaude with docker compose pull && docker compose up -d instead.

The vendored CloudCLI version must stay at or above the fixes for:

HolyClaude v1.6.8 vendors CloudCLI 1.37.3 with its existing compatible runtime dependency tree, including patched ws, multer, DOMPurify, Express, path-to-regexp, Hono, PostCSS, fast-uri, jws, minimatch, picomatch, tar-fs, and YAML resolutions. Its copied better-sqlite3 12.11.1 metadata matches the official Node 26 engine range while retaining the same registry URL and integrity. The release workflow also stores digest-bound CycloneDX, SPDX, and Grype reports for each full/slim and amd64/arm64 candidate. Scanner output is release evidence, not a claim that the image has zero vulnerabilities.

CloudCLI is a single-user service. Its account controls one shared workspace and credential context. Putting CloudCLI behind a tunnel or sharing its URL does not create separate users, tenants, workspaces, or credential boundaries.

The release gate keeps the original Grype report, CycloneDX and SPDX SBOMs, scanner database evidence, image digest and checksums. The upstream dependency policy records accepted upstream vulnerabilities without changing their raw severity or fix data. Acceptance is not remediation. Official releases and exact retained modified third-party components are identified separately. HolyClaude-owned components, unknown origins, malformed reports, source failures and integrity mismatches still block delivery.

Grype suppresses indirect kernel findings for Debian's linux-libc-dev headers by default. HolyClaude checks the exact built-in rule and retains those ignored records separately. Ignored findings must still bind to a real SBOM component; an arbitrary ignore cannot bypass provenance checks.

EAS CLI 24.14.0, Netlify CLI 27.14.1 and Vercel CLI 63.1.2 keep their official npm dependency trees. Their upstream vulnerability findings remain accepted and unresolved; the release scanners continue reporting the installed versions and advisories.

CloudCLI, its plugins and the FFmpeg security build remain exact retained modified third-party inputs. Updated npm and Wrangler also use their official dependency trees.

Apprise 2.0.1 renamed its email PGP public-key URL parameter from pgpkey to pgppub. HolyClaude normalizes existing mailto, mailtos, deltachat and deltachats notification URLs before validation or delivery. If both parameters are present, the explicit pgppub value wins.

The old review ledger, OpenVEX and v1.6.4 release approvals remain historical evidence. They do not authorize v1.6.8 or claim its affected components are fixed. The review policy explains both paths.

The workflow validates the raw and normalized SBOMs and binds the dependency report to the actual scanner output, database, immutable input inventory and platform image digest. CycloneDX's embedded SPDX enum predates Artistic-dist, so the recorded normalization represents that identifier through license.name. Other schema errors still stop the release. Evidence is uploaded separately; the Docker image index still contains exactly the two runtime platforms.

The default ./data/claude mount persists Claude Code sessions and, from v1.5.5, Git global configuration and GitHub CLI authentication. Treat it as credential-bearing storage. Do not commit it, share it broadly, or store it in an unencrypted backup.

• Claude Code session data is stored in ./data/claude/ on the host by the default Compose files. Other bundled tools may read credentials from their own container files, bind mounts, or environment variables.
• HolyClaude operates no credential relay and does not proxy or intercept provider credentials
• Bundled tools read credentials from container-local files, bind mounts, or environment variables and send authenticated requests directly to the providers you configure
• Provider requests necessarily carry the authentication material required by that provider; do not treat the container as a boundary that keeps credentials off the network

The container has unrestricted outbound network access. This is required for:

• AI provider API calls (Anthropic, Google, OpenAI)
• npm/pip package installations
• Git operations (clone, push, pull)
• Any web requests Claude Code makes during development tasks

Do not port-forward HolyClaude to the public internet. CloudCLI exposes a full shell and holds your AI provider credentials. A simple password is not sufficient protection — basic auth gets brute-forced, and one compromise means an attacker has arbitrary code execution, access to your workspace, and a paid Claude Code instance running on your credentials.

If you need to reach HolyClaude from outside your local network, use:

• Tailscale — WireGuard mesh VPN, zero open ports, identity-based auth. Recommended for personal and small-team use.
• Cloudflare Tunnel — Outbound-only tunnel to Cloudflare's edge, optional Cloudflare Access SSO in front. Recommended when you need a public hostname or shared access.

Both options avoid forwarding HolyClaude's application port through your router. Tailscale provides encrypted mesh transport and identity controls. Cloudflare Tunnel provides encrypted transport to Cloudflare's edge; Cloudflare Access is a separate configuration step when you need identity controls and Access audit logs. See the Remote Access & Exposure section of the README for full details.

If you discover a security vulnerability in HolyClaude:

1. Do not open a public GitHub issue
2. Use GitHub Security Advisories to report privately
3. Include: description, steps to reproduce, and potential impact
4. You will receive a response within 48 hours