alt Hacker NewsDocker works but the part that bit me was not the filesystem, it was the agent needing real credentials and network access to be useful. What I ended up doing is running the CLI agent in a throwaway working copy with only the env vars that one task needs, and treating anything it writes as a patch to review rather than something that lands directly. Curious if anyone has found a lighter option than a container that still stops it from reaching things like ssh keys.
I am using something similar. I then setup an additional container with Caddy that has the API keys and modifies headers so the AI containers never see them. Pi for example can use this setup.
For SSH I've started migrating from one prover wide key to multiple project scoped keys. I was also using SSH inside the container but realized I could just make commits inside and then eventually push from outside.
I think hardening tips for Docker/Podman could warrant its own "Ask HN" post - not just for reducing exposure to agents but also all the recent supply chain attacks.