Do You Trust Your Agents? Five Quick Ways to Contain Them

Do you trust your agents?

Most of us use coding agents every day now. Give one a vague request, walk away, and come back to a pile of mostly working software. It’s brilliant, right up until you remember you’ve handed a probabilistic machine access to your files, credentials and network.

In this week’s Dev Digest, we’re looking at Docker’s Mark Cavage’s talk on exactly this question from WeAreDevelopers North America. In his demo, an AI agent was running inside a container, a setup many of us would consider safe. But the container had been given access to the host’s Docker socket, a common shortcut, and the agent used it to reach a secret file on the host machine. Containers were designed to keep applications apart, not to hold back a tool that can install software and run its own code. So we thought we’d share a few tips we picked up from the talk.

✅ Five things to do today

1. Audit what it can reach. Check Compose files, CI configs and dev containers for mounted sockets, privileged mode and broad host mounts like your home directory.
2. Use a harder boundary. A VM, micro-VM, disposable cloud machine or spare box. Let the agent have free rein inside it, and you can stop approving every single command.
3. Lock down the network. Block outbound traffic by default and allow only what the task needs: package registries, your Git host, specific APIs.
4. Keep credentials out of reach. Use scoped, short-lived tokens and a proxy or secrets manager that injects them, rather than a personal access token sitting in the agent’s environment.
5. Set permissions in rules, not prompts. Mark’s own agent can read his email and draft replies, but it can never press send. The capability simply isn’t there. Ask of every integration: could this be read-only?

Once more than one person or agent is involved, also make it visible, stoppable and written down as config in the repo, so a teammate can run the same setup.

Agents don’t have to be perfect, and trust doesn’t have to be either. Risk is a spectrum, and you can move fast once the foundations are solid. The agents may write the code, but you still own what ships.

📺 Want more? Watch the full talk

There’s plenty more in the session: the live escape demo and the contained re-run, a network proxy that lets agents use credentials without ever seeing them, an open specification for describing sandboxed agent environments, and how to run agents in the cloud when you close your laptop. Watch it here: Manufacturing Trust: Speed and Safety in the Age of Agents