A few weeks ago I gave my coding agent permission to run shell commands, watched it run cargo test, and felt good about myself. Then it hit me what I had actually done. "Let the model run shell commands" is just a friendly way of saying "let a program I do not fully control execute arbitrary code on my laptop." That is the textbook definition of remote code execution. I had built myself an RCE machine and handed it the keys.
So I went looking for a way to box it in. This is what I tried, why Docker was the wrong tool, and what I ended up building instead.
The obvious answer, and why it is wrong
"Put it in a container" is everyone's first instinct, and it is not crazy. But Docker is the wrong shape for this specific job:
Cold start. An agent does not run one command, it runs hundreds of short ones. A 200ms+ spin-up per command turns a snappy session into a slideshow.
