Container Use

You will want this the first time an agent runs a command you did not read closely enough. The deciding trait in daily use is that your working tree simply stops being involved: each agent gets its own environment and its own branch, so you can start three on the same task and compare what comes back. Nothing you have open is at risk while they work.

Pick it if you already trust an agent's thinking and not its hands. Pick Sculptor if you want the same separation with a graphical review, or skip both if you only ever run one agent at a time.

Read the badge before the pitch. The project declares itself early development, commits continue, and no tagged release has appeared since August 2025, so anyone installing this is tracking a moving target with no version to name in an incident review. It also requires a working container engine and git on the host, which moves a dependency onto every machine that wants the protection.

What it does right is the failure path: a run you dislike is a branch and an environment you discard, and your own checkout was never a participant in the mistake.

The design is unusually legible. 1. Agent work is committed to its own branch, so inspection uses tools the reader already trusts rather than a bespoke viewer. 2. Acceptance is split into two distinct operations, one that brings the history across and one that brings only the resulting state, and distinguishing them is a real semantic choice most tools elide. 3. Checking out an agent's environment lets a human continue from where it stopped.

The design is agnostic about which agent produced the commits, so it should survive both model and vendor churn without modification.

Read the ownership before the licence. This is a corporate open-source component from a company whose actual product is the engine underneath, so the giveaway is a distribution strategy rather than generosity. There is no price, no tier and no revenue attached, and none is intended.

That makes its lifespan a function of the parent's priorities rather than its own adoption, which is the usual risk with strategic freeware: it survives while it serves the roadmap. A likely acquirer exists for the parent, a CI or platform vendor, and this would travel with it as a footnote. Position: adopt the pattern, and expect the implementation to follow somebody else's plan.

Zero licence cost, and the real cost is operational: this expects a working container runtime on sixty machines, which is a fleet standard, an image policy and a support queue rather than an install command. There is no headless mode, so it stays a desktop habit and never becomes a control I can enforce centrally. Nothing on the row offers SSO, an audit log or a retention statement, because there is no service to attach them to.

Onboarding is an hour for anyone comfortable with branches. Approved with conditions: teams already running containers locally, and no claim to security in the questionnaire.

Apache-2.0, installed from a tap or a shell script, and registered with one claude mcp add line pointing at its stdio transport. That is the part I like most: it is a server, not a client, so it does not care which agent I am running this week and it never asks me for a key. My credentials stay with whatever is calling it.

Local models are not its business, since it hands out environments rather than inference. A fork is plausible, the surface is small and the language is Go, though I would rather the upstream kept tagging releases.