You're running them in containers, and not in VMs on separate network through network filter and logger?
My agentic workloads happen on two physical machines dedicated only to agentic workloads that share a VLAN with only eachother, with single token access to the specific repositories they are meant to push to and limited scope, hard limited credentials pulled from the hardware store on hardware token/fingerprint request only.
I view the safety around unmonitored agentic work in a similar way to how I view working with viruses or bacteria in a disease lab.
This stuff isn’t magic, it isn’t intelligent, but it is dangerous and needs to be handled with careful intent.
I only heard about smolvm yet and they are YC, so I'm hesitant to use them as they will probably one day pull the rug.
As for the rug pull concern, I'm committed to open source with 2 pieces of evidence.
1. oss license 2. Business model is accruing revenue from offering hosted service + inbound due to the open source project. The business model + open source is aligned.
disclaimer: maintainer of smol machines
I ask because I’ve found that as isolation increases, so does friction, and then of course capabilities.
That means agents can collaborate on issues locally without needing network access to an external tracker, which could help with the sandboxing problem. You can then sync when it is deemed safe.
It’s called Epiq on Github.