How to Set Up Docker Isolation for Complete Sandboxing of Desktop Commander MCP

Desktop Commander MCP can run inside a Docker container with full filesystem isolation by using the install-docker.sh script, which creates persistent volumes for tools and data while mounting only explicit host directories you choose.

This guide walks through the complete Docker sandboxing setup for Desktop Commander MCP, an AI-powered tool automation server. The Docker isolation approach ensures that all tooling, configuration files, and user data remain containerized, with controlled access to your host system through selective volume mounts.

Why Use Docker Isolation for Desktop Commander

Running Desktop Commander MCP in Docker provides three key advantages:

• Security containment – The container has no direct host filesystem access except through volumes you explicitly define
• Environment consistency – The same node:lts-alpine base image works across macOS, Linux, and Windows (via Docker Desktop)
• Instant cleanup – Removing the container or volumes restores a clean state without residue on your host

The sandboxing mechanism relies on four persistent Docker volumes that survive container restarts, combined with the --rm flag that ensures each command runs in a fresh container instance.

Understanding the Docker Image Architecture

The Desktop Commander Docker image is defined in the repository's Dockerfile with a five-stage build process:

1. Base layer – Starts from node:lts-alpine for minimal footprint
2. Dependency install – Runs npm install --ignore-scripts to prevent untrusted post-install code
3. Binary rebuild – Rebuilds the @vscode/ripgrep binary required for fast recursive searches
4. Source build – Copies source code and executes npm run build
5. Entry point – Sets node dist/index.js as the container command (the MCP server entry point)

This architecture ensures the built image contains only compiled, verified code with no development dependencies exposed at runtime.

The Four Persistent Volumes Explained

The [install-docker.sh](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh) script automatically creates and manages these volumes:

Volume	Purpose	Container Mount Point
dc-system	System packages, binaries, libraries	/usr
dc-home	User configs, dotfiles, SSH keys, Git config	/root
dc-workspace	Development projects, source code	/workspace
dc-packages	Package caches (npm, pip, etc.)	/var

These volumes are created once on first run using docker volume create, then attached to every container instance via -v dc-system:/usr style arguments. Because the container launches with --rm, the runtime environment is ephemeral, but your installed tools and data persist across invocations through these named volumes.

Running the Docker Installer

Prerequisites

Docker Desktop must be installed and running before executing the installer.

Installation Command

bash <(curl -fsSL https://raw.githubusercontent.com/wonderwhy-er/DesktopCommanderMCP/refs/heads/main/install-docker.sh)

The [install-docker.sh](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh) script performs these operations automatically:

• Verifies Docker availability and daemon status
• Pulls the latest image (mcp/desktop-commander:latest)
• Interactively prompts for host folders to mount
• Creates the four persistent volumes if they don't exist
• Constructs the Docker argument array
• Updates Claude Desktop's claude_desktop_config.json
• Runs a persistence verification test

Folder Mounting Options

During installation, the script asks which host directories you want accessible inside the container. Selected paths are mapped under /home inside the container while preserving their original absolute structure:

Host path: /Users/alice/Projects
Container path: /home/Projects

This mapping is added to the args array passed to Claude Desktop.

Configuring Claude Desktop for Docker Mode

After installation, your Claude Desktop configuration contains a JSON entry like this:

{
  "mcpServers": {
    "desktop-commander": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "dc-system:/usr",
        "-v", "dc-home:/root",
        "-v", "dc-workspace:/workspace",
        "-v", "dc-packages:/var",
        "-v", "/Users/you/Projects:/home/Projects",
        "mcp/desktop-commander:latest"
      ]
    }
  }
}

With this configuration, Claude Desktop launches the MCP server by invoking Docker directly. The image is pulled automatically on first run if not already present locally.

Manual Docker Commands for Advanced Usage

Run a One-Off Command in the Sandbox

docker run -i --rm \
  -v dc-system:/usr \
  -v dc-home:/root \
  -v dc-workspace:/workspace \
  -v dc-packages:/var \
  mcp/desktop-commander:latest node -e "console.log('Hello from Docker!')"

Check Sandbox Status

bash <(curl -fsSL https://raw.githubusercontent.com/wonderwhy-er/DesktopCommanderMCP/refs/heads/main/install-docker.sh) --status

This displays the health of each volume and confirms the container runs with --rm for ephemeral execution.

Reset to Clean State

bash <(curl -fsSL https://raw.githubusercontent.com/wonderwhy-er/DesktopCommanderMCP/refs/heads/main/install-docker.sh) --reset

The --reset flag removes all four persistent volumes while preserving any host-folder mounts. This is useful when you need to eliminate installed tools or corrupted configurations without reinstalling Docker or the base image.

Adding Custom Host Folder Mounts

To mount additional directories after initial installation, edit Claude Desktop's configuration directly:

{
  "mcpServers": {
    "desktop-commander": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-v", "dc-system:/usr",
        "-v", "dc-home:/root",
        "-v", "dc-workspace:/workspace",
        "-v", "dc-packages:/var",
        "-v", "/Users/alice/Docs:/home/Docs",
        "-v", "/Users/alice/Projects:/home/Projects",
        "mcp/desktop-commander:latest"
      ]
    }
  }
}

Restart Claude Desktop after modifying this configuration.

Key Source Files Reference

File	Purpose
Dockerfile	Container image definition with build stages
[install-docker.sh](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/install-docker.sh)	Interactive installer and volume management
[README.md – Docker section](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/README.md#option-6-docker-installation)	Official Docker installation documentation
[package.json](https://github.com/wonderwhy-er/DesktopCommanderMCP/blob/main/package.json)	Runtime dependencies including @vscode/ripgrep

Summary

• Docker isolation for Desktop Commander MCP uses four persistent volumes (dc-system, dc-home, dc-workspace, dc-packages) to maintain state across ephemeral container runs
• The installer script automates volume creation, image pulling, folder mounting, and Claude Desktop configuration
• Host access is strictly opt-in through explicit volume mounts under /home in the container
• Reset capability allows instant cleanup of installed tools without affecting host-folder mounts
• All configuration lives in claude_desktop_config.json with Docker as the command and image-specific args

Frequently Asked Questions

Does Docker sandboxing prevent Desktop Commander from accessing my files?

Desktop Commander in Docker mode can only access host directories you explicitly mount during installation. The container has no default access to your home directory, system files, or other projects unless you add them to the volume list in Claude Desktop's configuration.

What happens to my installed tools when I restart Claude Desktop?

Tools and packages persist because they are stored in named Docker volumes (dc-system, dc-packages), not in the ephemeral container layer. Each restart launches a fresh container instance, but the volumes attach your previous environment automatically.

Can I run Desktop Commander with Docker on Apple Silicon Macs?

Yes. The node:lts-alpine base image supports both AMD64 and ARM64 architectures. Docker Desktop on Apple Silicon will automatically pull and run the appropriate variant without additional configuration.

How do I troubleshoot if the Docker container fails to start?

Run the status check command to verify volume health and configuration validity. Ensure Docker Desktop is running and the mcp/desktop-commander:latest image is available locally with docker images. Check Claude Desktop's logs for Docker-specific error messages in the MCP server output panel.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}