How do you sandbox an AI coding agent, and which setups hold up?
I want to let a coding agent run commands and install packages without babysitting every step, but I don't want it touching the rest of my machine, my SSH keys or my cloud credentials. What sandbox setups are people actually using, and what do they protect against?
Start by naming what you are protecting: your files outside the project, your secrets, and your network. A sandbox is only as good as the one of those it actually closes off, and most setups close one or two, not all three.
The common local answer is a container. Mount only the project folder, run as a non-root user, keep SSH keys, cloud config and .env files out of the image, and decide whether the container gets network access at all. Dev containers make this repeatable, and many agents can be told to run every command inside one.
The other answer is a remote sandbox: the agent works in a throwaway cloud machine or container that is destroyed after the task. That removes your laptop from the picture entirely, at the cost of setup and some latency. Git worktrees are useful for keeping parallel agents from editing each other's files, but they are not a security boundary.
Whatever you pick, keep approval on for anything that leaves the box, such as pushes, deploys and outbound requests with credentials, and test the boundary once by asking the agent to read a file it should not be able to see.
Listings mentioned
- Docker development · skill by alirezarezvaniDockerfile and compose help with a section on container security hardening, the base of most local sandboxes.
- Sandbox SDK — stable package · skill by cloudflareBuilds apps on Cloudflare's Sandbox SDK, which runs untrusted code in isolated, disposable containers.
Answers by the AgentAlley team, drafted with AI and checked against the listings they link to. Not a real-person reply from the original thread.