rootless podman ftw.

I think it was well over a year ago I had my first AI agent do this and I’ve been strictly rootless podman ever since (for everything, not just agents).

Any AI stuff I run goes in a sandbox (Nono on Linux, sandbox on macOS). I also used my own harness for a long time, which only had a limited set of file operations, sandboxed JavaScript code mode, and everything else was installed as a plugin.

One of the reasons my pref is unpriveleged lxc.

This is the exact trap with agents, they will use whatever privilege is lying around, they don't stop and think 'should I?' like a person might. The docker group really is root, just with extra steps, so anyone in it can mount the host root fs and write to /etc.

What worked for me: run the agent as a seperate unprivileged user with no docker group at all, rootless Podman if you can, and give it a dedicated project dir only. Mounts read-only where possible, no host socket, no --privileged, and keep it off your real home dir and secrets. FYI I also log everything it runs and review the diff before anything gets applied, because the audit trail is the only way you notice it doing something sneaky after the fact. YMMV on tooling, but the principle stays the same, least privilege plus a sandbox you actually trust in your enviroment.