cclaude: Add

Run claude in a container with just the holes that I need. Stops the
endless permission prompts.

This deliberately does not have access to any secrets, so no `git push`
or `ssh`.

diff --git a/cclaude b/cclaude
new file mode 100755 (executable)
index 0000000..12d9d50
--- /dev/null
+++ b/cclaude
@@ -0,0 +1,42 @@
+#!/bin/sh
+# Run claude without permission prompts in a podman container
+set -eu
+
+IMG=localhost/claude
+
+# build image on demand
+if ! podman image inspect "$IMG" >/dev/null; then
+    podman build -t "$IMG" -f - /run <<EOF
+FROM fedora:latest
+RUN dnf install -y git strace gdb python3 python3-pytest gh rpmbuild jq yq \
+    && dnf clean all
+EOF
+fi
+
+
+if [ "${1:-}" = sh ]; then
+    cmd=bash
+    shift
+else
+    cmd="$HOME/.local/bin/claude --allow-dangerously-skip-permissions --dangerously-skip-permissions"
+fi
+
+podman run -it --rm --userns=keep-id --init --network=host \
+    -v $HOME/.buck:$HOME/.buck \
+    -v $HOME/.cache:$HOME/.cache \
+    -v $HOME/.claude.json:$HOME/.claude.json \
+    -v $HOME/.claude:$HOME/.claude \
+    -v $HOME/.config/gh:$HOME/.config/gh:ro \
+    -v $HOME/.config/git:$HOME/.config/git:ro \
+    -v $HOME/.local/share/claude/:$HOME/.local/share/claude \
+    -v $HOME/.local/bin/:$HOME/.local/bin \
+    -v $HOME/amutable:$HOME/amutable \
+    -v $HOME/debian:$HOME/debian \
+    -v $HOME/upstream:$HOME/upstream \
+    -v $HOME/tmp:$HOME/tmp \
+    -v /tmp:/tmp \
+    -w $PWD \
+    -e HOME=$HOME \
+    --device=/dev/kvm \
+    $IMG \
+    $cmd "$@"