Yeah I discovered your blog a few days ago: I've got a setup not unlike yours. > So rather than pick one, this post advocates layering both, in the spirit of d

Yeah I discovered your blog a few days ago: I've got a setup not unlike yours. > So rather than pick one, this post advocates layering both, in the spirit of defense in depth: a sandbox VM wraps your containers along with the whole toolchain, and that sandbox reaches the internet but has no route to anything private. Yup it's the only proper way. And that is true not just for AI harnesses/agents (that shall try to escape), but also for stuff like Plex/Jellyfin/Immich/private pastebin etc. If you care about security, there really simply is zero reason to run containers on the bare metal.