Docker Sandbox Template — Claude Code with DeepSeek

Run Claude Code in a Docker sandbox powered by DeepSeek models.

This template extends the official docker/sandbox-templates:claude-code base image and pre-configures all environment variables needed to use DeepSeek's Anthropic-compatible API. You only need to supply your DeepSeek API key at runtime.

What's configured

Variable	Value	Purpose
ANTHROPIC_BASE_URL	https://api.deepseek.com/anthropic	Routes Claude Code to DeepSeek
ANTHROPIC_MODEL	deepseek-v4-pro[1m]	Default model (1M context)
ANTHROPIC_DEFAULT_OPUS_MODEL	deepseek-v4-pro[1m]	Maps Opus → V4 Pro
ANTHROPIC_DEFAULT_SONNET_MODEL	deepseek-v4-pro[1m]	Maps Sonnet → V4 Pro
ANTHROPIC_DEFAULT_HAIKU_MODEL	deepseek-v4-flash	Maps Haiku → V4 Flash
CLAUDE_CODE_SUBAGENT_MODEL	deepseek-v4-flash	Sub-agents use flash model
CLAUDE_CODE_EFFORT_LEVEL	max	Maximum reasoning effort
CLAUDE_CODE_AUTO_COMPACT_WINDOW	786432	Optimised for 1M context
CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC	1	Reduces unnecessary API calls

Prerequisites

• Docker Desktop installed
• A DeepSeek API key (starts with sk-)
• sbx CLI (ships with Docker Desktop)

Quick start

1. Build and push to a registry

docker build -t docker.io/dajneem23/sbx-deepseek:v1 --push .

2. Store your DeepSeek API key

Since DeepSeek isn't one of the built-in sbx service secrets, use a custom secret. This sets ANTHROPIC_AUTH_TOKEN inside the sandbox and the proxy replaces the placeholder with your real key on outbound requests to api.deepseek.com:

sbx secret set-custom \
  --host api.deepseek.com \
  --env ANTHROPIC_AUTH_TOKEN \
  --value sk-your-deepseek-api-key

Or pipe it from an environment variable (avoids shell history):

echo "$DEEPSEEK_API_KEY" | sbx secret set-custom \
  --host api.deepseek.com \
  --env ANTHROPIC_AUTH_TOKEN \
  --value -

3. Run a sandbox

sbx run --template docker.io/dajneem23/sbx-deepseek:v1 claude

Claude Code starts inside the sandbox, connected to DeepSeek. Run /model to confirm the active model.

Alternative: local load (no registry)

If you don't want to push to a registry:

# Build the image locally
docker build -t sbx-deepseek:v1 .

# Save to a tar
docker image save sbx-deepseek:v1 -o sbx-deepseek.tar

# Load directly into the sandbox runtime
sbx template load sbx-deepseek.tar

# Store your API key (once)
sbx secret set-custom \
  --host api.deepseek.com \
  --env ANTHROPIC_AUTH_TOKEN \
  --value $ANTHROPIC_AUTH_TOKEN

# Run
sbx run --template sbx-deepseek:v1 claude

Network access

If your sandbox uses a restrictive network policy, allow-list the DeepSeek API domain:

sbx policy allow network "api.deepseek.com:443"

Model reference

DeepSeek model	Best for
deepseek-v4-pro[1m]	Complex reasoning, large codebases (1M context)
deepseek-v4-flash	Fast, cost-efficient tasks, sub-agents

Troubleshooting

"ANTHROPIC_AUTH_TOKEN is not set" warning — Run sbx secret set-custom to store your DeepSeek API key (step 2 above). Verify it exists with sbx secret ls.

Connection errors — Verify the sandbox can reach api.deepseek.com:443. Check your network policy with sbx policy list.

Claude Code starts but uses Anthropic models — Run /model inside Claude Code to verify; if it shows Anthropic models, the env vars aren't taking effect. Make sure the template was built and pushed correctly.

Overriding model selection

All model variables are baked into the image as ENV defaults. To override one at runtime, build a derivative image or use a kit that exports the variable.