> At Greptile, we run our agent process in a locked-down rootless podman container so that we have kernel guarantees that it sees only things it’s supposed to.

This sounds like a runc container because they've not said otherwise. runc has a long history with filesystem exploits based on leaked file descriptors and `openat` without NO_FOLLOW.

The agent ecosystem seems to have already settled on VMs or gVisor[2] being table-stakes. We use the latter.

1. https://github.com/opencontainers/runc/security/advisories/G...

2. https://gvisor.dev/docs/architecture_guide/security/

"Early civilizations had no concept of zero..."

- Access to files in the repositorie(s)

- Access to the patch/diff being reviewed

- Ability to perform text/semantic search across the codebase

That doesn’t require running the agent inside a container on a system with sensitive data. Exposing an API to the agent that specifically give it access to the above data, avoiding the risk altogether.

If it's really important that the agent is able to use a shell, why not use something like codespaces and run it in there?