Containers are not a robust way to isolate untrusted programs. A lightweight VM is probably the best balance between usability and security.

They are effective at fostering a false sense of security though.

What specifically are you concerned about when running an LLM agent in a container versus a VM.

Assuming a standard Docker/Podman container with just the project directory mounted inside it, what vectors are you expecting the LLM to use to break out?

Well if you’re running docker on MacOS it’s running in a VM.