Pretty much regardless of harness, running a coding agent (by general convention) means approving or whitelisting commands one by one - or skipping all that with something like Claude Code’s --dangerously-skip-permissions and living in danger-land.
I’ve scratched this itch recently with a Sandbox for Agents for a personal AI assistant, over MCP. The reasoning is the same here: let the agent run pretty much anything inside a sandbox while reducing the attack surface, and allow for project-specific host resources to be exposed when needed.
Enter bur: the agent runs with full permissions inside a rootless podman container. Nix does the heavy lifting and the project’s devshell (shell.nix or flake) is the container environment, so there are no images to build or maintain.
nix profile install github:jeliasson/bur
Then, from any project with a devshell:
bur
Project settings are configurable in a .bur.yaml file: the command to run, extra tools from the host, network ports, fs mounts, envs, clipboard and so on. The inner workings are described in how it works; the short version is a fresh one-shot container per run, gone when the agent exits.
If you find it useful, let me know!