How to Safely Give AI Agents a Terminal

Sandbox AI coding agents: disposable Linux terminals with gVisor (runsc), network isolation, and hard resource limits - not system prompts. Practical isolation with Rexec.