Comment by zenoprax

I usually commit outside the sandbox. Agents will see the git history and will emulate that but they can't sign the commits. If I authorize a series of commits I can just `git rebase -i HEAD~N` and adjust the messages and re-sign at the same time. With git hooks as a threat vector I'm considering just giving them read-only access to `.git` otherwise I can't safely go back in there without the sandbox.

I don't give it access to GH - it can read most things via API or web scraping fast enough and I manually run the commands I need outside the sandbox.

No need for SSH - it's running locally.

---

Given how many holes you're poking into the container I think you'd be better served with a real VM.