Full threadaregsar·I have settled on using docker sandboxes sbx which basically sandboxes the agent in a micro vm running on the host and locks down accessView on HN