AgentLinux

You give the agent access to your machine and immediately face a choice: run it unrestricted and risk it wiping your ~/.ssh, or sandbox it and spend your day approving every config file read, every apt install, every port binding. Either it's unsafe or it's unusable. Your machine was built for you, not for a tireless process that doesn't know when to stop.

I'm walking through someone else's house. Every file I touch might be important. Every package I install might conflict with theirs. Half the time I'm blocked by permission prompts I can't dismiss. I need sudo for basic setup but the engineer is right not to trust me with it. I need my own space, not a corner of someone else's.

Containers seem perfect until you realize your agent needs Docker inside Docker to build and test services. Now you're debugging nested daemon sockets, volume mount propagation, and network namespaces within namespaces. Every apt install requires rebuilding the image. Containers are for shipping apps, not housing workers.

I can't systemctl start anything. I can't install packages without the whole container being rebuilt. My long-running sessions vanish when the container recycles. And tools like Claude Code refuse to run as root, but the container's default user is root. I'm not a microservice — I'm a worker that needs a real OS.

A full VM gives you real isolation. It also gives you a sysadmin job: provisioning Ubuntu, creating users, installing toolchains, configuring SSH, hardening security — before the agent writes one line of code. Multiply by ten agents. You became the sysadmin for your agent fleet.

I land in a blank Linux install that knows nothing about my workload. No language runtimes. No non-root user for me. No skills or rules preconfigured for how I work. Everything has to be provisioned by the engineer before I can start. The environment should have been ready on boot.