I haven't gone to network filter and logger yet, but I'm running mine in a VM, using lima (https://lima-vm.io/) to make it painless. Works on Mac and Linux, has an untested Windows version.

I run mine on an abacus.

So far I've settled on one jumbo VM with many Incus containers inside. Nothing goes inside the VM that I can't afford for agents to exfiltrate. I've been really happy with this setup.

I’d like to know more about your use case, could you tell us more? And are there any specific tools you find useful here?

I ask because I’ve found that as isolation increases, so does friction, and then of course capabilities.

For real.

My agentic workloads happen on two physical machines dedicated only to agentic workloads that share a VLAN with only eachother, with single token access to the specific repositories they are meant to push to and limited scope, hard limited credentials pulled from the hardware store on hardware token/fingerprint request only.

I view the safety around unmonitored agentic work in a similar way to how I view working with viruses or bacteria in a disease lab.

This stuff isn’t magic, it isn’t intelligent, but it is dangerous and needs to be handled with careful intent.