The Cheapest Way to Sandbox an AI Coding Agent on Windows
Docker. WSL. VMs. All work, but all are heavy when you just need to stop an AI agent from touching your whole drive. The simplest sandbox Map the agent's working folder to its own drive letter. Windows treats it as a real drive. The agent sees a clean filesystem root. If it runs rm -rf / , it only nukes its own sandbox. Local folder → drive letter : subst.scsoi.com WebDAV/cloud → drive letter :…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.