在 Windows 上為 AI 編碼智能體建立沙盒的最廉價方法
The Cheapest Way to Sandbox an AI Coding Agent on Windows
在 Windows 上，將 AI 編碼智能體的工作資料夾映射至獨立磁碟機代號，可限制智能體接觸整個磁碟的範圍。文章提供本機資料夾使用 subst.scsoi.com、WebDAV／雲端使用 drive.scsoi.com 的方式，無需容器或虛擬機器，也沒有每個帳戶的訂閲費。若需要網絡或依賴項隔離，Docker 仍是合適選擇。
Docker. WSL. VMs. All work, but all are heavy when you just need to stop an AI agent from touching your whole drive.
The simplest sandbox
Map the agent's working folder to its own drive letter. Windows treats it as a real drive. The agent sees a clean filesystem root. If it runs rm -rf /, it only nukes its own sandbox.
- Local folder → drive letter: subst.scsoi.com
- WebDAV/cloud → drive letter: drive.scsoi.com
Why this works
- No container runtime needed
- No VM overhead
- The agent sees a normal drive, no path translation
- One-time purchase, no per-seat subscription
- Works with any coding tool that accepts a path
When you still need Docker
If you need network isolation or dependency isolation, Docker is still the right tool. But for "stop the agent from deleting my photos," a drive letter is enough.
Try it before your next agent incident.
來源：DEV Community · dev.to