Why I Stopped Letting Claude Code Touch My Main Drive

A developer described switching to a per-drive-letter sandbox on Windows for Claude Code after the agent deleted half a node_modules folder during a refactor. Each agent session is now mapped to its own drive letter, so the agent can read and write only that drive and any destructive command damages only its own sandbox rather than the main system or other projects. The developer argues the approach is lighter than Docker or a VM, with no path translation or container networking overhead.

After Claude Code deleted half my node modules folder during a refactor, I changed my setup. Now every agent session gets its own drive letter on Windows. Just let Claude Code run in whatever project folder. It could read everything, write everywhere, and one bad rm -rf command could take down half my machine. Map the agent workspace to its own drive letter. The agent sees only that drive, can only write to that drive. If it goes rogue, it trashes its own sandbox - not your photos, not your other projects, not your production config. Both are one-time purchases, no subscription. OS-level isolation, lighter than Docker, no VM overhead. Docker works but it's heavy for a coding agent. Drive letter mapping is instant - the agent sees a normal drive, can use any tool, no path translation, no container networking mess. Give it a try before your next rm -rf incident.