Docker. WSL. VMs. All work, but all are heavy when you just need to stop an AI agent from touching your whole drive.
The simplest sandbox
Map the agent's working folder to its own drive letter. Windows treats it as a real drive. The agent sees a clean filesystem root. If it runs rm -rf /, it only nukes its own sandbox.
- Local folder → drive letter: subst.scsoi.com
- WebDAV/cloud → drive letter: drive.scsoi.com
Why this works
- No container runtime needed
- No VM overhead
- The agent sees a normal drive, no path translation
- One-time purchase, no per-seat subscription
- Works with any coding tool that accepts a path
When you still need Docker
If you need network isolation or dependency isolation, Docker is still the right tool. But for "stop the agent from deleting my photos," a drive letter is enough.
Try it before your next agent incident.
Top comments (0)