A container is a process with boundaries. It shares the host kernel, but it cannot see the host's files, processes, or network sockets unless you explicitly hand them over. That property — isolated by default, exposed by request — is exactly the contract an AI agent needs when it runs code on your machine. Agents are getting good enough to be useful, which means they are getting dangerous enough to be contained. This article walks through why a bare shell is not a boundary, where containers sit on the isolation spectrum, and how to wrap an agent's work in a disposable Docker sandbox without turning your deployment into an orchestration project.
Why a Bare Shell Is Not a Boundary
An agent that executes commands on your host gets the full surface of your machine. Every file the agent writes lands in your real filesystem. Every process it spawns can see your environment variables, and environment variables are where secrets live. Every port it opens is a port on your network. None of this requires malice. A model that writes a loop with a wrong exit condition can fill your disk. A tool that misparses a path can overwrite a file it was only supposed to read. A dependency pulled from a registry can ship with a post-install hook, and the agent will happily run it in your shell.
