Justy: Okay, so Freestyle just dropped this piece on sandboxes, and I think Cody's going to hate it in like three different ways, but also maybe agree by the end.
Cody: That's a hell of an intro. What's the argument?
Justy: Sandboxes suck because they're built on a lie: that you can predict what an agent will need. You can't. So instead of giving agents a real computer, everyone builds a fake one—just bash, fake filesystems, proprietary APIs—and calls it safety. But it's actually control.
Cody: Okay, I'm already skeptical. That's a pretty strong claim.
Justy: Yeah, but wait. They're saying VMs are the right answer because they let agents discover what the task requires inside a boundary you actually control. Isolation without removing reality.
Cody: Mm-hm.
Justy: I got into this on a plane yesterday, and I think there's something real here, but also some overreach. How's your week been, by the way?
Cody: Long. I was debugging this thing where an agent hit the edge of what a tool could do, and I literally had to add a new API endpoint because the tool was too constrained. So, uh, Freestyle might have a point.
Justy: Of course you did. Okay, let's dig in. The core thing they're saying is that sandboxes interrupt the feedback loop. Run, observe, search, change, repeat—agents need that cycle to actually work. Sandboxes break it by removing the tools that make the cycle possible.
Cody: That part is solid. But they're conflating two things: isolation and capability. You need both. The question is how you get both without building a proprietary OS pretending to be Linux.
Justy: Right. So Vercel's bash-tool is just bash plus grep, jq, pipes—basically context search. Freestyle says that's fine for that slice of work, but it breaks the moment the task escapes the shape of the tools.
Cody: Exactly. Agent needs a renderer, agent needs apt, agent needs a browser, agent needs services. None of those are in the tool list, so you either add more APIs or the agent fails. Eventually you've built a worse computer than just giving it Linux.
Justy: And that's where RigKit comes in. They're open-sourcing it on GitHub—freestyle-sh slash rigkit. It's not a command runner, it's a workspace. You snapshot a prepared VM image with all the toolchains, dev server, everything. When you restore, you get an isolated branch, SSH access, the whole thing.
Cody: Okay, that's actually smart. You're not trying to fake the OS; you're giving the agent a real one with VM-shaped boundaries. Snapshot, restore, fork, pause—those are real primitives.
Justy: But here's where I push back a little. The argument slides from 'sandboxes suck for open-ended work' to 'VMs are always the answer,' and I don't think that's quite right.
Cody: Fair. For narrow execution—JavaScript snippet, no filesystem, throw it away—an isolate is perfectly fine. Fast, cheap, simple. The article kind of acknowledges that but doesn't emphasize it enough.
Justy: Exactly. And I think for most teams right now, the real problem isn't sandbox vs. VM. It's that they're trying to route every task through the same harness when the work requires different shapes. Context search is different from dependency install is different from test reproduction.
Cody: Yeah, that's actually the insight buried in here. The harness should match the boundary, not the other way around. Design the boundary first, give the agent as much computer as fits inside it.
Justy: Right. So for teams actually shipping agents on real codebases, this probably matters. If you're trying to do test reproduction or package debugging, a real OS is not negotiable. You hit the sandbox wall fast.
Cody: And the sub-second VM startup thing changes the cost model. If you can snapshot and restore in under a second and support forking, you're not paying the price you used to.
Justy: You sound like you're selling it.
Cody: I'm not not selling it. The article makes a decent case that VMs solve a real problem better than sandboxes do, but it's not because sandboxes are evil—it's because they're the wrong primitive when the agent needs to discover what the task requires.
Justy: And that's the actual argument. Not 'sandboxes bad, VMs good,' but 'isolation is good, but don't achieve it by removing reality.' A real boundary around a real computer beats a fake boundary around a fake one.
Cody: Exactly. Okay, I'm convinced enough.
Justy: Yeah. This one actually landed for me. Worth reading if you're shipping agent infrastructure.