I built Airlock last week around a simple idea: agent containers shouldn’t have your CLI credentials. It worked. But proxying the LLM runtime showed that a shim isn’t enough. You also need user input, MCP tools, and conversation history. So I built Tightbeam: keep the LLM client and credentials on the host, stream output + tool calls into the container over a Unix socket, and execute only in the workspace.

The container is no longer an agent.

https://github.com/calebfaruki/tightbeam

#ai #llm #docker #infoSec