I must have been living under a rock for the past five years, because Crystal went completely unnoticed until last week. As a long time Ruby programmer, I'm eager to give it a try.
That's probably the best way of relating the problem to non-engineers that I've heard.
I started running Claude Code in a devcontainer with limited file access (repo only) and limited outbound network access (allowlist only) for that reason.
This weekend, I generalized this to work with docker compose. Next up is support for additional agents (Codex, OpenCode, etc). After that, I'd like to force all network access through a proxy running on the host for greater control and logging (currently it uses iptables rules).
This workflow has been working well for me so far.
Still fresh, so may be rough around the edges, but check it out: https://github.com/mattolson/agent-sandbox