為何我不再讓 Claude Code 存取主硬碟
Why I Stopped Letting Claude Code Touch My Main Drive
作者在 Claude Code 重構期間刪除部分 node_modules 後，改為讓每個 Agent 工作階段在 Windows 上使用獨立磁碟機代號。這種隔離方式只讓 Agent 存取及寫入指定磁碟機，並提供本機資料夾和 WebDAV／雲端儲存兩種沙盒方案。兩種方案均為一次性購買，無需訂閲；作者稱其比 Docker 輕巧，且無需虛擬機開銷。
After Claude Code deleted half my node_modules folder during a refactor, I changed my setup. Now every agent session gets its own drive letter on Windows.
What I used to do
Just let Claude Code run in whatever project folder. It could read everything, write everywhere, and one bad rm -rf command could take down half my machine.
The fix
Map the agent workspace to its own drive letter. The agent sees only that drive, can only write to that drive. If it goes rogue, it trashes its own sandbox - not your photos, not your other projects, not your production config.
- Local folder sandbox: subst.scsoi.com maps any local folder to a real drive letter
- WebDAV/cloud sandbox: drive.scsoi.com mounts WebDAV/storage as a drive letter
Both are one-time purchases, no subscription. OS-level isolation, lighter than Docker, no VM overhead.
Why this beats Docker
Docker works but it's heavy for a coding agent. Drive letter mapping is instant - the agent sees a normal drive, can use any tool, no path translation, no container networking mess.
Give it a try before your next rm -rf incident.
來源：DEV Community · dev.to