What's this about?
A small post pointing out the obvious thing most people are doing: running coding agents as their own user, on their main machine, with access to everything that user can reach. It only got 42 points but produced the most practical isolation thread of the window.
What does "isolation" concretely mean for an agent?
Not "the agent promises not to". It means the agent literally cannot reach what you did not give it. Three levels appear in the thread. A separate user account is the weakest — it stops the agent touching your files but not other agents' files, and does not stop privilege escalation. A container is better. A dedicated VM, on separate hardware, with only the project directory shared in, is what the most careful people in the thread actually run: the worst case becomes "the agent destroyed this project folder."
What's the community saying?
- The most detailed setup described: a KVM VM on a machine under the desk with no access to the user's home directory, documents, photos, `~/.ssh`, or API keys, reached over SSH with a VNC session for anything that needs a GUI.
- A lighter-weight version several people run: a base NixOS image in Incus, spun up per project, sharing only that project folder from the host.
- The counter-argument that will win in practice: "my work computer has nothing of personal value, the agent does my work, why wouldn't I just run this" — followed by the observation that we have all been executing arbitrary code from npm and PyPI for a decade.
- The rebuttal that matters for freelancers and consultants: the counter-argument holds only if work and personal genuinely live on different machines, which for most people they do not.
- A first-instinct suggestion — "just make a separate user for agents" — gets correctly pushed back on: separate users can still read each other's data, and are still one misconfiguration from root.