#Non-Obvious Decisions

• docker info, not docker --version, is how claudio detects your runtime. docker --version reports only the CLI client version — with both Docker Desktop and OrbStack installed, the client can report one runtime while every actual docker command talks to another. Use docker info when checking yours.
• No Docker socket is mounted into agent containers. Mounting /var/run/docker.sock is a direct path to host-root access from inside the sandbox. A repo that needs to run docker itself requires an opt-in rootless Docker-in-Docker sidecar.
• Dependency directories (node_modules, etc.) are bind-mounted, not offloaded to a named volume. A named volume is 7–15× faster on filesystem metadata operations, but the host loses visibility into the directory — which is the reason to use claudio over a headless remote sandbox. A metadata-heavy build is slower on a bind mount as a result; the architecture doc's Appendix A has the measurements.
• The Anthropic credential is shared across every container (see First-run auth). There is no per-instance isolation: revoking one instance's access revokes all of them.
• No SSH key enters a container unless you list it with claudio config add ssh_keys <path> (see ssh_keys). The agent can read any key it is handed, for every host that key opens, so which keys cross the sandbox boundary is your call rather than "whatever is in ~/.ssh".