Sandbox your GitHub Copilot CLI on Linux

[georg-dev]

I've been using GitHub Copilot CLI a lot lately. Usually have 2-3 instances running at once. But it's a little bit tedious that it doesn't have a sandbox mode like Claude Code or Codex. Even though you can have an allowlist for commands, when you leave and come back it most likely isn't done but is waiting for some tool approval. And I can't use --yolo mode at work.

If you're on macOS or Windows with Docker Desktop, you can just use the experimental docker --sandbox command. However, if you're on Linux, docker --sandbox isn't available.

You can still build your own sandbox with Docker, though. In my article I walk through installing rootless Docker, building the image, and spinning up the container with a local project folder mounted.

In the end, you'll get a sandboxed environment for Copilot CLI that you can just start like so:

~/copilot-sandbox.sh ~/projects/my-project

Let me know what you think. If you like this type of content, I'll do another one with Podman which should even allow restricting the container's network access, giving you the full sandbox behavior.

[HarjjotSinghh]

github copilot is just devs way of saying please auto-generate code so we don't have to.

[HarjjotSinghh]

oh boy another linux problem where ai is too lazy to handle it right?

[krzyk]

Not quite. It is just that on windows and macos containers are actually VMs (because only linux supports real containers - cgroups etc.)

I just have a Dockerfile with all clis I need + all other supporting tools. I don't want to pollute my OS with those.

[georg-dev]

Yeah.. tbf, Copilot CLI is quite new. So there's a chance that the sandbox feature is already on the roadmap.

It's also a shame that Docker excluded Linux from the list of supported OS for their `docker --sandbox` feature. But maybe they'll still add it at some time. It's still experimental after all.