If your agent executes code, you want to run it in an isolated environment. I learned this the hard way. I also know a couple of people who let OpenClaw go nuts and had to wipe out their laptops after a few days to clean up the mess. Two rules you must always follow: 1. Agent that runs code → isolated environment 2. Agent that controls a browser → isolated environment But that generates a new problem: that environment has to start quickly, use as little memory as possible, and give you…