We need sandboxing for any agent, so we run it within Docker - so we use CLI.

I use vscode with containers extensively. Not sure why containers imply CLI.