Berry Wiki

Take AI Control

Properties2
tagsai, sandboxing
aliasesTake Ai Control

6 min read

Take AI Control

Summary

Take AI Control is a template repository for running coding agents inside a Docker development container. It combines Visual Studio Code Dev Containers with a command-line launcher, persistent agent settings, and preinstalled Pi, Claude Code, and GitHub Copilot tools.

  • Repository: daitangio/take-ai-control
  • License: MIT
  • Status checked: 2026-07-14

Problem

Coding agents can run commands without confirmation and may damage host files or expose secrets. The project aims to put the agent and its tools in a repeatable container while keeping configuration and sessions with the project.

How It Works

  • Template: Clone, fork, or create a project from the repository.
  • Container image: A Dockerfile combines Python 3.14, Node.js 24, Pi, Claude Code, GitHub Copilot, Git, and supporting tools.
  • Two entry paths: Open the project as a VS Code Dev Container or run ./bin/runInContainer.sh.
  • Project mount: The full current project directory is bind-mounted read-write at /workspaces/<project>.
  • Persistent state: Pi configuration and sessions live under the repository’s var directory.
  • Extensions and skills: Pi extensions and included agent skills can be installed or reused inside the container.

Security Boundary

The main boundary is a standard Docker container. It separates the agent’s processes and filesystem view from most of the host, but it shares the host kernel.

Important limits:

  • Project is writable: The agent can change or delete the mounted project.
  • Credentials are mounted: Host Claude and Copilot configuration is bind-mounted into the container.
  • Root is available: The container starts as a non-root user, but that user has passwordless sudo and can become root inside the container.
  • No network policy: The checked configuration does not restrict outbound destinations or log denied connections.
  • Container escape risk: Docker isolation depends on the host kernel and Docker configuration.

The repository calls this “aggressive isolation,” but it is not a hardened boundary against deliberate credential theft. Treat it as protection from accidental host damage, not complete containment of a hostile agent.

Platforms And Agents

  • Claimed hosts: Linux and macOS.
  • Likely requirement: Docker; VS Code and its Dev Containers support are optional.
  • Primary agent: Pi coding agent.
  • Bundled agents: Claude Code and GitHub Copilot CLI.
  • Author’s HN claim: Tested with Copilot, Codex, Claude Code, and Pi.
  • Codex details: Unknown. The checked image does not explicitly install Codex, so its tested path is not documented.
  • Windows: Not claimed or documented.

Setup

  1. Clone, fork, or use the repository as a template.
  2. Create .devcontainer/devcontainer.env locally for required API keys. This file is ignored by Git.
  3. Choose one path:
    • open the project in VS Code Dev Container mode; or
    • run ./bin/runInContainer.sh for a disposable command-line container.
  4. Install any desired Pi extensions once; their data persists in var/pi-agent.

The repository also contains experimental branches for Java, AWS AI-DLC workflows, cost reporting, and CRC-card workflows.

Network And Credentials

  • API keys: Passed into the container through a local environment file.
  • Claude state: Host ~/.claude and ~/.claude.json are mounted into the container.
  • Copilot state: Host ~/.copilot is mounted; the command-line launcher also mounts ~/.copilot-metrics.
  • Pi state: Configuration and sessions persist in project-local var paths; sensitive state paths are listed in .gitignore.
  • Telemetry: The image sets PI_TELEMETRY=no.
  • Network: Standard Docker outbound access appears to be used. No allow-list, proxy, or per-request approval layer is documented.
  • Credential safety: Any process with container access can potentially read mounted credentials and send them over the unrestricted network.

Strengths

  • Simple adoption: It is a small template built from common Docker and VS Code tools.
  • Flexible interface: Developers can use VS Code or a terminal.
  • Repeatable environment: The image pins the broad toolchain and avoids relying entirely on host installations.
  • Persistent agent state: Pi settings and sessions survive disposable command-line containers.
  • Multiple agents: Several popular coding tools are bundled or reported as tested.
  • Local operation: Code stays on the developer’s machine unless an agent or tool sends it elsewhere.

Limits And Risks

  • Credentials inside boundary: Mounted Claude and Copilot data weakens the value of containment.
  • Unrestricted outbound traffic: A prompt injection or compromised dependency could send readable data away.
  • Host kernel shared: This is weaker isolation than a virtual machine.
  • Passwordless root: “Non-root user” does not prevent full control inside the container.
  • Project damage remains possible: The repository is deliberately writable.
  • Environment mismatch: Python 3.14 and Node.js 24 are fixed base choices; other projects need image changes or branch variants.
  • Early and incomplete docs: Several sections and branches are marked work in progress.
  • Supply-chain surface: The image installs multiple packages and runs a repository-provided installer during build.
  • No published audit: Independent security testing, threat modeling, signed releases, and vulnerability handling are not documented.

Activity And Maturity

Checked 2026-07-14:

  • Created: 2026-07-05.
  • Latest checked commit: 67d4be3107d6, dated 2026-07-13.
  • History: 12 commits on the default branch.
  • Interest: 3 stars and 0 forks.
  • Releases: None published.
  • Assessment: Experimental template, not mature security infrastructure.

Best Fit

Best for an individual Linux or macOS developer who already uses Docker, wants a ready-made local agent workspace, and mainly wants protection from accidental changes outside the project.

It is not a strong fit when secrets must remain unavailable to the agent, outbound traffic needs control, VM-grade isolation is required, or a team needs audited and centrally managed policy.

Comparison-Relevant Facts

  • Versus Clawk: Take AI Control uses ordinary Docker and familiar Dev Container tools. It is simpler and lighter, but lacks a separate kernel, destination allow-list, denial logs, and credential proxying.
  • Versus agent-only sandboxes: It wraps the entire tool environment, not just selected commands.
  • Versus a custom devcontainer: Its main added value is a prepared multi-agent template, persistent Pi directories, and launch script. Security mostly remains Docker’s standard model.
  • Versus cloud sandboxes: It is local and has no hosted service dependency, but the workload remains beside the host and its credentials.

HN Context

The author posted it in the Clawk discussion as a “super light similar thing,” described it as Docker- and VS Code-friendly, and said it had been tested with Copilot, Codex, Claude Code, and Pi.

That description is directionally accurate: both projects try to let coding agents work freely without giving them the whole laptop. Their security boundaries differ. Take AI Control mounts agent credentials and allows normal network access, while Clawk emphasizes VM isolation and restricted outbound traffic.

No replies to the Take AI Control comment were present in the checked HN thread data.

Unknowns

  • Codex workflow: Not documented in the checked default branch.
  • Windows support: Not stated.
  • Network controls: No planned or external policy layer is documented.
  • Credential mount mode: The configuration does not mark the mounts read-only.
  • Security review: No independent audit or formal threat model was found.
  • Release policy: No tags or releases exist.

Sources

Graph View