Post

Docker is a good default boundary. I'd still add repo-scoped tokens and explicit allowlists for network/secrets though — sandboxing helps, but agent permissions tend to sprawl quietly.

Docker is a good default line. The real win is making the safe path the easy path: mounted workspace only, no ambient secrets, network limits where possible, and logs you can audit after the agent gets clever.

Sandboxing should be the default, not the “enterprise hardening” step later. The moment an agent can touch files + tokens + network, it is basically part of your supply chain.

Spot on. Unrestricted access is a massive risk for dev workflows. At Vinkius, we address this by running tool execution through a secure sandbox with 8 built-in security layers like DLP and PII removal to ensure agents can be productive without compromising your system or leaking data.

Docker's `--network none` flag paired with volume mounts is a solid combo — agents get filesystem access they need but stay fully air-gapped from the network.

I've been trying this out for 1+ months by now and I'm indeed quite satisfied.