An AI agent that can't break my servers
How I let an AI coding agent manage my infrastructure without giving it the means to wreck it.
I wanted to set up services from my phone: describe what I want and have an agent build and deploy it. The quick way is to give the agent root and hope for the best. I didn't want that.
The agent runs in a container with no access to the Docker socket, no sudo, no SSH to either server, no deploy credentials and no route to the rest of the network. It can only reach a few repositories, with a token scoped to just those.
Logs reach it one way. A job on the other machine fetches them, strips out anything sensitive and puts them in a folder the agent can only read. Deploys are done by a person clicking a button. If any of those boundaries is ever crossed, I get an alert.
On paper first
The plan is written out in phases, with one hard requirement before anything else: backups I've actually tested. For every design decision I write down which alternatives I rejected, what could break if it goes wrong, and what the agent will never get, even if it would be handy later.