# How to Set Up Docker Isolation for Complete Sandboxing of Desktop Commander MCP

> Learn to set up Docker isolation for complete sandboxing of Desktop Commander MCP. Use our script to create persistent volumes and mount only chosen host directories for secure desktop management.

- Repository: [Eduard Ruzga/DesktopCommanderMCP](https://github.com/wonderwhy-er/DesktopCommanderMCP)
- Tags: how-to-guide
- Published: 2026-08-07

---

**Desktop Commander MCP can run inside a Docker container with full filesystem isolation by using the [`install-docker.sh`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh) script, which creates persistent volumes for tools and data while mounting only explicit host directories you choose.**

This guide walks through the complete Docker sandboxing setup for Desktop Commander MCP, an AI-powered tool automation server. The **Docker isolation** approach ensures that all tooling, configuration files, and user data remain containerized, with controlled access to your host system through selective volume mounts.

## Why Use Docker Isolation for Desktop Commander

Running Desktop Commander MCP in Docker provides three key advantages:

- **Security containment** – The container has no direct host filesystem access except through volumes you explicitly define
- **Environment consistency** – The same `node:lts-alpine` base image works across macOS, Linux, and Windows (via Docker Desktop)
- **Instant cleanup** – Removing the container or volumes restores a clean state without residue on your host

The sandboxing mechanism relies on four persistent Docker volumes that survive container restarts, combined with the `--rm` flag that ensures each command runs in a fresh container instance.

## Understanding the Docker Image Architecture

The Desktop Commander Docker image is defined in the repository's [`Dockerfile`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/Dockerfile) with a five-stage build process:

1. **Base layer** – Starts from `node:lts-alpine` for minimal footprint
2. **Dependency install** – Runs `npm install --ignore-scripts` to prevent untrusted post-install code
3. **Binary rebuild** – Rebuilds the `@vscode/ripgrep` binary required for fast recursive searches
4. **Source build** – Copies source code and executes `npm run build`
5. **Entry point** – Sets `node dist/index.js` as the container command (the MCP server entry point)

This architecture ensures the built image contains only compiled, verified code with no development dependencies exposed at runtime.

## The Four Persistent Volumes Explained

The [[`install-docker.sh`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh)](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh) script automatically creates and manages these volumes:

| Volume | Purpose | Container Mount Point |
|--------|---------|----------------------|
| `dc-system` | System packages, binaries, libraries | `/usr` |
| `dc-home` | User configs, dotfiles, SSH keys, Git config | `/root` |
| `dc-workspace` | Development projects, source code | `/workspace` |
| `dc-packages` | Package caches (npm, pip, etc.) | `/var` |

These volumes are created once on first run using `docker volume create`, then attached to every container instance via `-v dc-system:/usr` style arguments. Because the container launches with `--rm`, the runtime environment is ephemeral, but your installed tools and data persist across invocations through these named volumes.

## Running the Docker Installer

### Prerequisites

Docker Desktop must be installed and running before executing the installer.

### Installation Command

```bash
bash <(curl -fsSL https://raw.githubusercontent.com/wonderwhy-er/DesktopCommanderMCP/refs/heads/main/install-docker.sh)

```

The [[`install-docker.sh`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh)](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh) script performs these operations automatically:

- Verifies Docker availability and daemon status
- Pulls the latest image (`mcp/desktop-commander:latest`)
- Interactively prompts for host folders to mount
- Creates the four persistent volumes if they don't exist
- Constructs the Docker argument array
- Updates Claude Desktop's [`claude_desktop_config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/claude_desktop_config.json)
- Runs a persistence verification test

### Folder Mounting Options

During installation, the script asks which host directories you want accessible inside the container. Selected paths are mapped under `/home` inside the container while preserving their original absolute structure:

```

Host path: /Users/alice/Projects
Container path: /home/Projects

```

This mapping is added to the `args` array passed to Claude Desktop.

## Configuring Claude Desktop for Docker Mode

After installation, your Claude Desktop configuration contains a JSON entry like this:

```json
{
  "mcpServers": {
    "desktop-commander": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "dc-system:/usr",
        "-v", "dc-home:/root",
        "-v", "dc-workspace:/workspace",
        "-v", "dc-packages:/var",
        "-v", "/Users/you/Projects:/home/Projects",
        "mcp/desktop-commander:latest"
      ]
    }
  }
}

```

With this configuration, Claude Desktop launches the MCP server by invoking Docker directly. The image is pulled automatically on first run if not already present locally.

## Manual Docker Commands for Advanced Usage

### Run a One-Off Command in the Sandbox

```bash
docker run -i --rm \
  -v dc-system:/usr \
  -v dc-home:/root \
  -v dc-workspace:/workspace \
  -v dc-packages:/var \
  mcp/desktop-commander:latest node -e "console.log('Hello from Docker!')"

```

### Check Sandbox Status

```bash
bash <(curl -fsSL https://raw.githubusercontent.com/wonderwhy-er/DesktopCommanderMCP/refs/heads/main/install-docker.sh) --status

```

This displays the health of each volume and confirms the container runs with `--rm` for ephemeral execution.

### Reset to Clean State

```bash
bash <(curl -fsSL https://raw.githubusercontent.com/wonderwhy-er/DesktopCommanderMCP/refs/heads/main/install-docker.sh) --reset

```

The `--reset` flag removes all four persistent volumes while preserving any host-folder mounts. This is useful when you need to eliminate installed tools or corrupted configurations without reinstalling Docker or the base image.

## Adding Custom Host Folder Mounts

To mount additional directories after initial installation, edit Claude Desktop's configuration directly:

```json
{
  "mcpServers": {
    "desktop-commander": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "dc-system:/usr",
        "-v", "dc-home:/root",
        "-v", "dc-workspace:/workspace",
        "-v", "dc-packages:/var",
        "-v", "/Users/alice/Docs:/home/Docs",
        "-v", "/Users/alice/Projects:/home/Projects",
        "mcp/desktop-commander:latest"
      ]
    }
  }
}

```

Restart Claude Desktop after modifying this configuration.

## Key Source Files Reference

| File | Purpose |
|------|---------|
| [`Dockerfile`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/Dockerfile) | Container image definition with build stages |
| [[`install-docker.sh`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh)](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh) | Interactive installer and volume management |
| [[`README.md`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/README.md) – Docker section](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/README.md#option-6-docker-installation) | Official Docker installation documentation |
| [[`package.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/package.json)](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/package.json) | Runtime dependencies including `@vscode/ripgrep` |

## Summary

- **Docker isolation** for Desktop Commander MCP uses four persistent volumes (`dc-system`, `dc-home`, `dc-workspace`, `dc-packages`) to maintain state across ephemeral container runs
- The **installer script** automates volume creation, image pulling, folder mounting, and Claude Desktop configuration
- **Host access** is strictly opt-in through explicit volume mounts under `/home` in the container
- **Reset capability** allows instant cleanup of installed tools without affecting host-folder mounts
- All configuration lives in [`claude_desktop_config.json`](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/claude_desktop_config.json) with Docker as the `command` and image-specific `args`

## Frequently Asked Questions

### Does Docker sandboxing prevent Desktop Commander from accessing my files?

Desktop Commander in Docker mode can only access host directories you explicitly mount during installation. The container has no default access to your home directory, system files, or other projects unless you add them to the volume list in Claude Desktop's configuration.

### What happens to my installed tools when I restart Claude Desktop?

Tools and packages persist because they are stored in named Docker volumes (`dc-system`, `dc-packages`), not in the ephemeral container layer. Each restart launches a fresh container instance, but the volumes attach your previous environment automatically.

### Can I run Desktop Commander with Docker on Apple Silicon Macs?

Yes. The `node:lts-alpine` base image supports both AMD64 and ARM64 architectures. Docker Desktop on Apple Silicon will automatically pull and run the appropriate variant without additional configuration.

### How do I troubleshoot if the Docker container fails to start?

Run the status check command to verify volume health and configuration validity. Ensure Docker Desktop is running and the `mcp/desktop-commander:latest` image is available locally with `docker images`. Check Claude Desktop's logs for Docker-specific error messages in the MCP server output panel.