Sandboxing a bot

Containers can be used for easy and effective isolation of agent harnesses from your development environment Letting agent harnesses, like Pi or Claude Code run on your machine with your credentials is convenient but also very insecure. Limiting the bots by telling them 'thou shalt not' is pretty much as useless as it is with people, so some proper limitations to capabilities are warranted. If the…