DEDUPED Hot AI repos, turned into use cases Get 5 a day

How to confine a coding agent to one project folder on Linux with Agent Security

Start an agent in a closed box where only one project directory exists and nothing else on the machine is visible.

Who it is forA developer on Linux who runs an agent across several client repositories and wants one agent session to see only one of them.

The problemAn agent started normally can reach home directories, SSH keys, other projects and credentials of installed tools.

The outcomeThe agent works inside a box where the project is at /workspace and other paths are absent, with the box's network setting chosen per box.

What you need first

  • A machine where you can run a shell and git (the README installs with git clone and ./scripts/shell/install.sh)
  • Claude Code or Codex installed as the agent you want to guard
  • A new terminal after install, since hooks load only when a session starts
  • For the sandbox use case: Linux with bubblewrap (bwrap) installed, since the README says it is required and macOS and Windows refuse

Steps

  1. Install bubblewrap so that bwrap is available on the machine, since the README says a missing one is a refusal.
  2. Complete the guard install with ./scripts/shell/install.sh and open a new terminal.
  3. solongate sandbox list
  4. solongate sandbox 001 claude
  5. solongate sandbox --explain 001

Prompt for your agent

On a Linux machine with bwrap installed, use the SolonGate repo at https://github.com/solongate/agent-security to create a sandbox box from the TUI Sandbox section for <project-path>, then run `solongate sandbox 001 claude`. Expected output: the agent starts with the project at /workspace and home directories absent. Verify by running `solongate sandbox --explain 001` and checking that the listed contents match the project only.

Caveat. The sandbox is Linux only, and the box's network stays on when the agent needs its model, so content leaving over the wire is handled by the DLP and egress layers rather than by the box.

Share: X LinkedIn Hacker News Email Copy link

Disclaimer

Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked "Seen in the wild", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email [email protected] and we will look at it promptly. Full disclaimer page