Docker works but the part that bit me was not the filesystem, it was the agent needing real credentials and network access to be useful. What I ended up doing is running the CLI agent in a throwaway working copy with only the env vars that one task needs, and treating anything it writes as a patch to review rather than something that lands directly. Curious if anyone has found a lighter option than a container that still stops it from reaching things like ssh keys.