> Task declares the container image and command, compute requests and limits, environment variables [...] Declares listeners the task exposes and an egress allowlist of hosts and ports the sandbox may reach. Use it to restrict an agent to, say, your LLM provider and your Git host.

I'm planning to buy a whole linux mini-PC to run my agents/code servers for more isolation. Codex/Claude Code let you run prompts on code over ssh (same with most IDEs) even on the desktop apps.

I wonder if that's going to be the new standard practice. You get a work laptop and an isolated agent box.

Running access control and network whitelists is always a maintenance challenge and it's easy to make mistakes.

I have 6 and ended up needing to use my gaming PC for a build server.

I think you could get by with 1 computer, but it’ll have to have a pretty decent machine.

Between agents running tests, CI, docker image builds, an average $400 mini PC won’t cut it.

Don’t forget also many older mini PCs don’t support KVM. Some newer ones don’t support AVX/ mongodb.

It’s not so easy to buy any old hardware sadly.

I think it will be, but I don't think you need a standalone machine! If you run things inside a VM, you can get safety and control over access and networks

A standalone machine is nice if you need more compute resources or if you want an always-on machine you can connect to from your laptop, phone, etc.

It doesn't look like Google's AX is quite the plug-and-play fit for running agents on a computer you own, since it requires setting up a K8S cluster, etc.

I think what's needed is something like a zero-setup combo of Tailscale and Firecracker

I'm trying to work towards that with my startup (https://github.com/gofixpoint/amika) but the bring-your-own-computer part doesn't work quite yet.

[flagged]