Policy Versus Physics: Docker Sandboxing for My AI SRE Agent
This is a follow-up to my first article about my semi-autonomous SRE agent, which covered the agent itself: investigation, scoped tools, human approval. This one covers the question I kept deferring: where does the agent's code actually run, and what happens when every other guardrail fails?
Everything I have written about this agent so far has been policy. Scoped tools instead of shell access. Validation hooks on every proposed change. Human approval before anything merges. Retrieved runbooks that inform but never command.
Policy is what the system is supposed to allow. It is written in code I wrote, reviewed by me, tested by me, which means it fails the way all code fails. A tool server with a path traversal bug. An allowlist with one regex that matches more than I intended. A validation hook that someone (me) disabled during a debugging session and forgot to re-enable.
The uncomfortable...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
