Preview. These maps are our reading of public sources and haven't been checked with the projects' maintainers yet.
container-use (Dagger)
MCP server and CLI from Dagger that gives each coding agent its own container and git branch, so several agents can work in parallel and you review or discard their branches.
container-use.com/Maintenance
Last release v0.4.2 on 2025-08-19; occasional commits through 2026-08-12 (Copilot CLI support, path-traversal fix); README still marks it 'experimental'. (checked 2026-10-25)
In Agent guardrails
Where it stands apart
- Is it actively maintained? maintenance or slowing (5% of 21 others)
- How is it mainly sustained? company or startup with a free product (no revenue yet) (10% of 20 others)
- Which shared standard or format does it mainly build on? Model Context Protocol (MCP) (19% of 21 others)
- What mainly decides whether an action is allowed? no per-action decision: it isolates, inventories, or records (24% of 21 others)
- If the guard itself breaks, is missing, or cannot decide, what happens by default? fails open: the action runs unguarded (12% of 17 others)
- Is enforcement kept out of the agent's reach? partly, some of it depends on prompts or settings the agent can reach (0% of 21 others)
What it shares with most of the community
- How is the main thing licensed? permissive open source (MIT/Apache/BSD) (67% of 21 others)
- Can it run entirely on your own device or infrastructure, without the maker's servers? yes (76% of 21 others)
- Do you need an account to use it? no account (67% of 21 others)
- Who is it for? developers (90% of 21 others)
- Which agents does it work with? any agent or process (not limited to a named list) (71% of 21 others)
- What is the main thing it protects? the developer's machine and files (52% of 21 others)
Not documented
The public sources we read don't say:
- Does it control the agent's outbound network access?
Nearest neighbors
- Drop 56% of 16 shared answers match
- Plimsoll 53% of 15 shared answers match
- Airlock 50% of 16 shared answers match
Every answer
| Question | Answer | Source |
|---|---|---|
| Is it actively maintained? | stands apart maintenance or slowing | source 2026-10-25 |
| How is the main thing licensed? | permissive open source (MIT/Apache/BSD) Apache-2.0 | source 2026-10-25 |
| How is it mainly sustained? | stands apart company or startup with a free product (no revenue yet) Free open-source project from Dagger, whose paid product (Dagger Cloud) is separate. | source 2026-10-25 |
| Can it run entirely on your own device or infrastructure, without the maker's servers? | yes | source 2026-10-25 |
| Do you need an account to use it? | no account Open-source CLI and MCP server installed via brew or script; README has no account or login. | source 2026-10-26 |
| Who is it for? | developers | source 2026-10-25 |
| Which shared standard or format does it mainly build on? | stands apart Model Context Protocol (MCP) Delivered as an MCP server for any MCP-compatible agent. | source 2026-10-26 |
| Where does it mainly step in? | at the OS or VM boundary (sandbox, container, syscall supervisor) Work happens in containers; the agent reaches them through MCP tools. | source 2026-10-25 |
| What mainly decides whether an action is allowed? | stands apart no per-action decision: it isolates, inventories, or records | source 2026-10-25 |
| If the guard itself breaks, is missing, or cannot decide, what happens by default? | stands apart fails open: the action runs unguarded Opt-in via MCP and agent rules; if the agent uses its built-in host tools instead, nothing stops it. | source 2026-10-25 |
| Which agents does it work with? | any agent or process (not limited to a named list) | source 2026-10-25 |
| In the default setup, where does the agent's work actually execute? | in a local VM, container, or OS sandbox | source 2026-10-25 |
| What is the main thing it protects? | the developer's machine and files | source 2026-10-25 |
| Does it keep a record of agent actions? | yes, ordinary logs or a timeline Command history and logs per environment. | source 2026-10-25 |
| Does it control the agent's outbound network access? | Not documented Network controls not documented in the README. | source 2026-10-25 |
| What is it mainly for? | letting agents run with fewer approvals, safely 'Go from babysitting one agent at a time to enabling multiple agents to work safely.' | source 2026-10-25 |
| Is enforcement kept out of the agent's reach? | stands apart partly, some of it depends on prompts or settings the agent can reach Relies on agent rules telling the model to use the container tools. | source 2026-10-25 |
Sources
This page was derived from:
- GitHub · github.com/dagger/container-use · read 2026-10-25
- Web page · container-use.com/ · read 2026-10-25
Are you a maintainer? Claiming and correcting projects is coming soon.