A practical guide to sandboxing your development environment and LLM agents using BubbleWrap (bwrap). The setup uses a shell script called `isolate` that mounts only necessary parts of the filesystem, mostly read-only, to limit damage from malicious dependencies or runaway AI agents. Integration with Nix wraps Claude Code to
Sort: