Session Environments
Local container sessions
Local container sessions execute commands inside Docker/Podman containers to add runtime isolation while preserving project access.
What local container sessions are
A per-session container is provisioned and commands run inside that container instead of directly on the host shell.
- Supported runtimes: Docker and Podman.
- Default image: `node:22-slim`.
- Project directory is mounted read/write to `/workspace`.
When to use them
- Use when you want shell/runtime isolation from your host OS.
- Use when you want reproducible command behavior tied to a container image.
- Use when you prefer agent command execution to stay within a managed sandbox boundary.
Constraints and caveats
- Docker/Podman must be installed and available before provisioning can succeed.
- Provisioning (runtime detection, image pull, container create) can add startup latency.
- Because the project directory is mounted into the container, treat this as runtime isolation, not file-level air-gapping.