Comment by aregsar

I have settled on using docker sandboxes sbx which basically sandboxes the agent in a micro vm running on the host and locks down access