Yes, that's how I am using it. However there is an experimental qemu microvm backend and a push for podman support if that is more interesting for you.
We use MCP when security and tight capability boundaries are important.
For example, even GitHub’s fine-grained tokens aren’t always fine-grained enough for our use cases. In those situations, it’s straightforward to build a small MCP server that exposes exactly the operations we want an agent to have access to.
That gives us a much smaller and more explicit attack surface, without having to manually audit every possible GitHub CLI invocation the agent might make.
I get this use-case, but what makes an MCP server better than a custom CLI tool that exposes those same operations? That's how I've solved similar things in the past.
Mcp just wraps the existing calls with a description of when to use them. Why would you write a cli for something like this? And clis generally have a help call but that doesn’t say when to use a tool just what it does
Eclipse Enclave does exactly that: There is an outbound firewall and secret injections, so that the agent never sees a real key. And it's fully open source: https://github.com/eclipse-enclave/enclave
What is missing in qemu + podman that we need rootful docker for this? Is there actual capability that is missing or is it more of a design choice by the eclipse enclave folks?
As soon as I tried Claude Code it was clear to me that I want it to run in yolo mode, but safely. I can very much recommend the Eclipse Enclave sandbox which is fully open source, see https://github.com/eclipse-enclave/enclave
Thanks for pointing to that project- I am glad there are more options out there and hope to discover more. Requiring a root docker setup is a non-starter for me though and I am otherwise taking some different design approaches that I think lead toward better security (perhaps at the cost of some convenience), but the concept is basically the same.
