I made a tool that creates sandboxes (docker, podman, orbstack, seatbelt, tart, Apple containers, containerd, kata, firecracker) and then sets up an agent (claude, codex, gemini, aider, opencode) inside it with max permissiveness (no prompts to call sed, etc).

It creates a CoW copy of your workdir for the agent to play in, and then you pull changes out using git diff/apply semantics.

You control network access, secrets, which files/dirs it has access to.

It's a MASSIVE time saver, and I use it as my daily driver.

https://github.com/kstenerud/yoloai