[seanlinehan]

This is definitely the way. There are good use cases for real sandboxes (if your agent is executing arbitrary code, you better it do so in an air-gapped environment).

But the idea of spinning up a whole VM to use unix IO primitives is way overkill. Makes way more sense to let the agent spit our unix-like tool calls and then use whatever your prod stack uses to do IO.

[skeptrune]

100% agree. However, if there were no resource tradeoffs, then a FUSE mount would probably be the way to go.