Safety-Redacted Transcript - Docker Sandboxes For Agents

This public transcript is intentionally redacted. The source talk included demonstrations and setup-oriented material for local agent isolation. The public version preserves the defensive concepts while removing operational commands, manifests, and sensitive-value handling mechanics.

Speaker And Context

Oleg Selajev discusses how to run local AI agents more safely. The talk is framed around the risk of giving autonomous tools broad access to a developer machine and then trusting prompt-level instructions to keep them safe.

Core Thesis

More autonomous agents need stronger boundaries. A policy written in a prompt or instruction file is not the same as an enforced isolation boundary. The talk advocates disposable isolated environments, explicit sharing rules, constrained network behavior, and sensitive-value handling outside the agent-visible workspace.

Risk Model

The talk emphasizes that agents become risky when they can combine:

1. access to private local context,
2. untrusted content from outside the user,
3. and communication beyond the local task.

The more autonomy and permissions the agent has, the more important it is to enforce boundaries outside the model.

Isolation Model

The public summary preserves these concepts:

• use a strong isolation primitive for local agent work,
• share only the files required for the task,
• route external communication through policy,
• keep sensitive values outside the agent-visible environment,
• make environments disposable and reproducible,
• and keep logs for review.

Operational setup details are redacted.

Team Rollout Lessons

The talk also frames sandboxing as a developer-experience problem. If isolated environments are too slow or empty, teams will bypass them. A practical rollout needs reusable configuration, pre-approved capabilities, policy defaults, and a clear path for vendors or platform teams to provide safe integrations.

Limits

Sandboxing reduces local-machine blast radius. It does not by itself solve application-level risks, such as an agent being granted broad access to communication tools. The safe lesson is to combine infrastructure isolation with product-level permissions and review.

Limits Of This Bundle

This redacted bundle supports architecture review and policy planning. It does not provide commands, setup files, or sensitive-value routing recipes.