This is why I told some colleagues several times to NOT put their user into the docker group AND to set the docker command for Claude at least to ‘ask every time’.

That fucker circumvents your guardrails all the time. “Oh I’m not allowed to read a .env file with the harness? Let’s check cat .env!” Yesterday Claude even wrote a little python script to try to print the .env file, because he thought he’d need it to debug a container. (Spoiler - the problem wasn’t even with some env vars and also the .env was just filled with dummy values as it is an example from a public repository anyways).