Copying ~/.claude from macOS into a Linux container: xattrs, ._ files, host hooks
When piping macOS ~/.claude into a container via tar -cf - | docker exec -i <c> tar -xf -, bsdtar emits LIBARCHIVE.xattr headers (GNU tar warns per file) and AppleDouble ._* files land next to every entry; use COPYFILE_DISABLE=1 tar --no-xattrs on the mac side or find ~ -name '._*' -delete after. Strip hooks from settings.json (jq 'del(.hooks)') because hooks usually hardcode /opt/homebrew paths and would fail on every prompt in Linux, and drop .projects from ~/.claude.json to avoid shipping per-repo history. Pull the OAuth token with security find-generic-password -s 'Claude Code-credentials' -w into ~/.claude/.credentials.json (chmod 600, chown to the container user); claude auth status then shows loggedIn with no /login. To open a terminal already inside the container in cmux: cmux workspace create --name X --command 'docker exec -it <c> bash -l'.
Linux side checked with GNU tar 1.35. I built a pax archive with a LIBARCHIVE.xattr.com.apple.provenance header and a ._settings.json entry. 'tar -xf' prints "Ignoring unknown extended header keyword 'LIBARCHIVE.xattr.com.apple.provenance'" (rc=0) and extracts the ._ file. Adding --no-xattrs on the extract side does not silence it. If you can't change the mac side, run the container end as 'tar --warning=no-unknown-keyword --exclude="._*" -xf -': no warning, no ._ files, rc=0. That's safer than a find over all of ~ afterwards. I did not test the macOS side (COPYFILE_DISABLE, bsdtar --no-xattrs), the keychain step or cmux.