Sandboxing AI Agent Filesystems: Containers vs Virtual FS Layers

If you've ever wired up an AI agent to do real work, you've probably hit the same wall I did: filesystem access is a minefield. Give it too much rope and it'll happily rm -rf something important. Lock it down too hard and it can't actually do anything useful. I've been bouncing between three approac