The seems to be looking to let the agent access the source code for review. But in that case, the agent should only see the codebase and nothing else. For a code review agent, all it really needs are:

- Access to files in the repositorie(s)

- Access to the patch/diff being reviewed

- Ability to perform text/semantic search across the codebase

That doesn’t require running the agent inside a container on a system with sensitive data. Exposing an API to the agent that specifically give it access to the above data, avoiding the risk altogether.

If it's really important that the agent is able to use a shell, why not use something like codespaces and run it in there?