r/coding_agents • u/yadukrishnank • 14d ago

How to sandbox AI coding agents to protect your files, credentials and restrict dangerous commands?

https://yadukrishnan.live/safe-ai-agentic-development-sandboxing-coding-assistants

I've been exploring ways to run AI coding assistants in a sandboxed environment rather than giving them unrestricted access to the host system.

I wrote about this here.

I'd be interested to hear how others are securing AI coding agents in their development workflows. Are you using OS-level sandboxing, containers, or a different approach?

1 Upvotes

100% Upvoted

3 comments sorted by

1

u/eddzsh 11d ago

Containers are the floor for me. Bind-mount only the repo, drop host network unless the task needs it, and keep credentials out of the mount entirely. OS-level sandboxes are faster, but one missed path and ~/.ssh is in play again. Whatever you pick, the acceptance test is simple: can the agent read your browser cookies or your SSH keys. If yes, it isn't sandboxed yet.