Outline - Docker Sandboxes For Agents

Speaker

Oleg Selajev discusses local AI agent isolation and safer developer workflows.

Safety Status

This is a safety-redacted public outline. Setup commands, manifests, and sensitive-value handling mechanics are omitted.

Thesis

Local agents should run inside enforceable, disposable isolation boundaries. Prompt-only instructions are not sufficient security controls.

Section Map

1. Introduction and framing.
2. Why autonomous local agents increase risk.
3. The toxic-flow model: private context, untrusted input, and outbound communication.
4. Why soft policy and approval prompts are insufficient.
5. Stronger local isolation as a safety primitive.
6. File-sharing, network, and sensitive-value-boundary concepts.
7. Reusable team configuration as developer experience.
8. IDE and workflow integration at a conceptual level.
9. Application-level risks that isolation does not solve.
10. Closing balance: speed and safety must be designed together.

Concepts

• Hard isolation: A boundary enforced outside the model prompt.
• Shared file scope: Only required files should be visible to the agent.
• Network policy: External communication should be explicit and reviewed.
• Sensitive-value isolation: Sensitive values should stay outside the agent-visible context.
• Disposable environment: The agent workspace should be easy to destroy and recreate.
• Team ergonomics: Safe defaults must be convenient enough that developers use them.

Not Included

• Commands.
• Manifests.
• Registry references.
• Credential-substitution mechanics.
• Reproduction steps from demos.

Safe Use

Use this talk to build checklists, rollout plans, and policy reviews for local agent execution.