Container Use — agentic threat model

Not certain from the listing — the description focuses entirely on the container runtime and environment management rather than the underlying foundation models used to drive the agent.

State persistence is managed via Git-based storage. Threats include Git repository poisoning, unauthorized state modification, and the exfiltration of sensitive data stored within the persistent container history.

The agent orchestrates custom toolchains and background services. Vulnerabilities here include insecure tool integration, execution of malicious binaries within the container, and the creation of compromised environment checkpoints.

Uses Dagger's container runtime for sandboxing. The primary infrastructure threats are container escape, privilege escalation to the host system, and unauthorized network access from background services running inside the container.

Not certain from the listing — there is no mention of built-in logging, execution monitoring, or guardrails to detect anomalous behavior inside the running containers.

Isolation is positioned as the core security control. However, security depends heavily on the configuration of the container runtime, access controls for Git storage, and the trust model of the image publication registry.

Designed to provide environments for other agents. A compromised agent could abuse this tool to spin up malicious background services or publish backdoored container images to shared registries, leading to cascading ecosystem failures.