I use a custom container image which bind mounts the current working directory, and has some popular coding agents preinstalled. There's also a firewall option, with a whitelist of hosts and IP addresses that the user can modify without having to rebuild the image.

https://github.com/ambarh/agent-silo