The Cheapest Way to Sandbox an AI Coding Agent on Windows

Docker. WSL. VMs. All work, but all are heavy when you just need to stop an AI agent from touching your whole drive.

Map the agent's working folder to its own drive letter. Windows treats it as a real drive. The agent sees a clean filesystem root. If it runs rm -rf /, it only nukes its own sandbox.

If you need network isolation or dependency isolation, Docker is still the right tool. But for "stop the agent from deleting my photos," a drive letter is enough.