Your AI coding agent can read your .ssh folder. It can edit your hosts file. It can delete your whole C: drive if it goes wrong.
Why are you letting it?
#
The fix
Map the agents workspace to its own drive letter. Done.
- Local folder workspaces: subst.scsoi.com
- WebDAV/cloud workspaces: drive.scsoi.com
The agent sees a normal drive. It writes there happily. It cannot see anything outside that drive.
#
No containers needed
You dont need Docker Desktop. You dont need a VM. You just need Windows drive mapping, which has existed for 30 years.
Both tools are one-time purchases. Set it up once, run agents worry-free forever.
source & further reading
dev.to — original article
DeepSeek V4.1 Flash in Claude Code and OpenCode: setup, test runs, and what it costs on four platforms
The Cheapest Way to Sandbox an AI Coding Agent on Windows
AI Helps Us Build Faster. Are We Learning Enough?