The split I've settled on: git worktrees for parallelism, containers only when I actually need isolation from the host.
Worktrees are cheap because they share the object store, so N agents each get their own working dir + branch without N full clones, and teardown is just `git worktree remove`. That solves the common case — two agents stomping each other's uncommitted files on the same repo. What it does NOT give you is isolation of the filesystem outside the repo, the network, or your secrets: a worktree agent can still read ~/.aws or curl anywhere.
So I only reach for a container/VM the moment an agent runs untrusted code or I care about blast radius — npm install on a sketchy dep, executing model-written shell, anything that could exfiltrate env vars. Rule of thumb: worktree for "don't let agents collide", container for "don't let an agent hurt the host". Most local setups only need the first, and people tend to reach for heavyweight sandboxing before they need it, then abandon it because it's painful.
A cheap middle ground that works locally: worktrees + a per-agent env file and a restricted PATH, so at least secrets aren't ambient without paying full container cost.
Worktrees are cheap because they share the object store, so N agents each get their own working dir + branch without N full clones, and teardown is just `git worktree remove`. That solves the common case — two agents stomping each other's uncommitted files on the same repo. What it does NOT give you is isolation of the filesystem outside the repo, the network, or your secrets: a worktree agent can still read ~/.aws or curl anywhere.
So I only reach for a container/VM the moment an agent runs untrusted code or I care about blast radius — npm install on a sketchy dep, executing model-written shell, anything that could exfiltrate env vars. Rule of thumb: worktree for "don't let agents collide", container for "don't let an agent hurt the host". Most local setups only need the first, and people tend to reach for heavyweight sandboxing before they need it, then abandon it because it's painful.
A cheap middle ground that works locally: worktrees + a per-agent env file and a restricted PATH, so at least secrets aren't ambient without paying full container cost.