If you haven’t already been running your agents in containers, you’re crazy. That said, this looks like a great way to manage those containers.

You're running them in containers, and not in VMs on separate network through network filter and logger?

Well, a lot of people haven't been running NodeJS libraries in containers for ages, which seems even more risky.

Technically, my laptop is a container!

But then it decides to exfiltrate all your shit even inside the container. Which is something I'm trying to lock down at work atm.

Everything needs to go through a proxy, whitelisted domains only, plus credential swapping/re-signing so that the agent never has the real credentials. Docker sandbox looks quite good (September) but I've been using iron proxy (if the author is reading this, fucking thank you bro!) to great effect.

I still haven't cracked "what if the agent decides to drop parts of your codebase somewhere it shouldn't" yet, but I'll figure it out.

many common local containers are not that hard for modern models to escape...

I have been running my dev setup in orb machines before agents. Very convenient when you have 50 Python or nodes deps.

any recommendation for macOS users?