Local freedom
Build, test, inspect, and refactor within the isolated development boundary.
AI Coding Safety
Your AI agent just wiped the database.
Give it full access without full risk by running it inside a boundary that you can rewind in seconds.The point is not to make AI coding agents timid. The point is to give them a safe place to work, where mistakes are contained before they reach home directories, production systems, credentials, or unrelated repositories.
Chander Dhall
Builder • Leader • Speaker
WIPEContain the mistake before it becomes the incident
AI coding safety · 2026
Core Decision
Do not debate power first.
Place it inside a boundary.
The report’s operating pattern is Full Access inside Docker, a VM, a dedicated operating system, or a coding-only cloud workstation. The agent receives room to work. Everything outside that boundary remains unreachable.
Personal and canonical state
Home directories, unrelated repos, password stores, cloud profiles, and Docker daemon control stay out.
Production authority
No destructive production database, cloud, deployment, or storage credentials inside the agent environment.
Source: report summary and introduction
Risk Shift
Full Access changes the failure mode from inconvenience to incident.
With sandboxing removed and approvals disabled, a syntactically valid command can still be catastrophically wrong. The high-risk pattern is broad machine reach plus ambiguous cleanup, deletion, migration, or environment repair language.
High-risk workstation mode
approval_policy = "never"
sandbox_mode = "danger-full-access"Wrong target
A cleanup command can select a real home directory instead of a temporary folder.
Wrong authority
A local agent with production credentials can reach real databases, storage, and cloud resources.
Wrong workspace
Opening the whole home directory turns unrelated files into neighboring project state.
Source: Full Access risk section
Defense Model
Instructions help. Boundaries decide what damage is possible.
The report treats instructions, sandbox settings, containers, Git, backups, and production identity controls as complementary layers. Each layer solves a different failure mode.
| Layer | Purpose | Limit | Board-level test |
|---|---|---|---|
| Global instructions | Clarify destructive-action behavior. | Guidance is not an operating-system boundary. | Can the agent still reach the wrong target? |
| Sandbox and approvals | Restrict routine host access and pause boundary crossings. | Full Access removes much of this protection. | What command runs without a pause? |
| Docker or VM | Reduce reachable files, processes, and identity scope. | Mounted files and credentials remain reachable. | What is mounted, injected, or routed? |
| Git and backups | Recover tracked and untracked work. | Untracked state needs separate protection. | What survives a full workspace deletion? |
| Production controls | Block destructive production authority from local tools. | Admin credentials defeat the layer. | Can the agent run DROP, TRUNCATE, or delete cloud resources? |
Source: layered defense table
Container Boundary
Docker works when the host is not quietly handed back.
The container is the outer boundary only if host home directories, SSH keys, cloud profiles, unrelated repositories, privileged mode, and Docker daemon control are not mounted into it.
Repository clone or volumeOne project per trust boundary.
Allowed
Development credentialsNarrow test identity, limited to required services.
Constrain
Host home or SSH directoryPersonal files and credentials become reachable from the container.
Exclude
Docker socket or privileged modeContainer control can become broader host control.
Exclude
Source: Docker containment rules
Daily Workflow
The VS Code pattern is familiar. The storage choice is the control point.
Dev Containers let terminals, extensions, builds, language servers, and the agent run inside the container. The difference between a host bind mount and a container volume clone is the difference between host exposure and a smaller development blast radius.
1Clone in volumeUse Dev Containers: Clone Repository in Container Volume.
2Install agent insideUse a container-specific Codex configuration and identity.
3Run Full Access insideBroad permissions apply to the container workspace.
4Commit and pushRegular remote checkpoints protect tracked work.
5Discard when neededRebuild the environment after questionable state or destructive behavior.
Convenient but exposed
The mounted repository can be changed or deleted from the container.
Better daily default
The canonical host home and unrelated repositories remain outside the boundary.
Smallest scope
More synchronization work, but a smaller blast radius for long autonomous runs.
Source: VS Code workflow and storage model
Recovery Model
A named volume is persistence.
It is not backup.
The durable source of truth is a remote Git repository plus independent backups. Docker volumes can preserve a workspace, but they do not replace source control, branch protection, or backups outside the agent’s writable reach.
Commit and push
Remote branches protect code history and reduce one-machine dependence.
Export or snapshot
Protect generated files and prototypes that are not ready for Git.
Protect merges
Branch protection blocks accidental force pushes and direct deletion.
Keep one outside reach
At least one backup destination stays unavailable to the agent session.
Source: backup and recovery guidance
Production Access
Docker protects local files.
It does not neutralize credentials.
If a container can authenticate to production and run destructive commands, the production boundary is incomplete. Production changes move through CI/CD, reviewed code, explicit approval gates, and logged release identities.
No destructive authority
No local development identity with DROP, TRUNCATE, privilege changes, backup deletion, or unrestricted migrations.
Read-only when rare
Rare production diagnostics use a separate read-only identity and a narrow workflow.
CI/CD owns change
Reviewed code, approval gates, audit trails, deletion protection, and independent recovery protect production.
The simplest production test:
If the agent can authenticate to production and run a destructive command, production has already been placed inside the agent’s blast radius.
Source: production databases and cloud resources
Boundary Selection
Choose the boundary by native tooling needs and remaining exposure.
Docker is the fast default for web, backend, data, CLI, and cross-platform repositories. Native platform work may need a VM, dedicated operating system, cloud workstation, or separate physical computer.
| Boundary | Best fit | Main benefit | Remaining exposure |
|---|---|---|---|
| Docker container | Web, backend, data, CLI, cross-platform work. | Fast rebuilds and small filesystem scope. | Mounted files, credentials, and reachable networks. |
| Local virtual machine | Windows or Linux native tooling. | Independent OS, filesystem, users, and snapshots. | Shared folders, clipboard, host credentials, network routes. |
| Dedicated boot disk | Native macOS, Windows, or Linux hardware work. | Complete native toolchain away from personal disks. | Any disk, identity, or service unlocked inside the dev OS. |
| Coding-only cloud machine | Remote development and team-standard workstations. | No direct access to local personal disks. | Cloud identity, network connectivity, assigned secrets. |
| Separate computer | Native development with maximum practical separation. | Independent hardware, storage, accounts, and OS. | Shared cloud accounts, removable media, production credentials. |
Source: boundary comparison table
Launch Checklist
Before a long autonomous run, verify the boundary.
The launch check is operational, not theoretical. It confirms where the agent can write, what identity it holds, what networks it can reach, and what survives a bad command.
Container or VM only
Full Access stays inside a recoverable development boundary.
No home root
The project root is not the full home directory or a broad personal folder.
No production authority
Cloud profiles, database admin roles, and production SSH keys are absent.
Push first
Important work is committed, pushed, and backed up outside the agent session.
- OpenAI documentation: Codex sandboxing, auto-review behavior, and AGENTS.md guidance.
- Developer platform documentation: VS Code Dev Containers, Docker bind mounts, Docker volumes, and Docker daemon protection.
- Operating-system and cloud references: FileVault, Hyper-V, Windows account controls, Azure Dev Box, Azure VM access controls, Ubuntu LUKS and AppArmor, EC2 Mac, and Google Compute Engine.
Source: report checklist and source notes
The Operating Question
Can the agent damage anything outside the recoverable boundary?
If the answer is yes, the boundary is not ready. Full Access is a productivity tool only after the reachable filesystem, credentials, network routes, and production authorities are deliberately constrained.
© 2026 Chander Dhall Methodworks, LLC. All rights reserved.