The Cheapest Way to Sandbox an AI Coding Agent on Windows

Docker. WSL. VMs. All work, but all are heavy when you just need to stop an AI agent from touching your whole drive.

The simplest sandbox

Map the agent's working folder to its own drive letter. Windows treats it as a real drive. The agent sees a clean filesystem root. If it runs rm -rf /, it only nukes its own sandbox.

• Local folder → drive letter: subst.scsoi.com
• WebDAV/cloud → drive letter: drive.scsoi.com

Why this works

• No container runtime needed
• No VM overhead
• The agent sees a normal drive, no path translation
• One-time purchase, no per-seat subscription
• Works with any coding tool that accepts a path

When you still need Docker

If you need network isolation or dependency isolation, Docker is still the right tool. But for "stop the agent from deleting my photos," a drive letter is enough.

Try it before your next agent incident.