How do you sandbox your coding agents?

Curious how others are handling isolation when running coding agents like Claude Code or Codex. Are you running them directly on your machine? Git worktrees? Docker? Something else?

I built SuperHQ because I wanted real VM isolation for each agent session. But I am curious what setups others are using and what pain points you are running into.