For some very basic level protection use devcontainers and install the agent into that.... A better approach is to use the Docker Sandboxes feature. Locks thin

For some very basic level protection use devcontainers and install the agent into that.... A better approach is to use the Docker Sandboxes feature. Locks things way down so that the agent only has access to the files you give it and you can lock down its network access too. Also does things like keep any credentials outside of the container (microvm actually).