Tools: How to Set Up a Sandbox Environment for GitHub Copilot CLI on Linux
The Challenge
Troubleshooting the Setup on Linux
1. Quickstart Limitations
2. CRLF Line Ending Issues
3. The Solution: Local Build
Persisting Session Data
How to mount the session state:
Conclusion
References When running AI coding agents like GitHub Copilot CLI, isolation is key for security and keeping your host environment clean. While Docker Desktop provides a native Sandbox feature for Mac and Windows, Linux users often face different challenges. In this post, I’ll share how to set up a robust sandbox environment for GitHub Copilot CLI on Linux, based on my recent experiments. Official Docker Sandboxes are currently not supported on Linux. To solve this, I used the following template:
henrybravo/docker-sandbox-run-copilot When using the repository above on a Linux machine, you might encounter a few hurdles: The "Option 1: Using Docker Sandbox" recommended in many guides is not applicable because the docker sandbox command is missing on Linux. If you try "Option 2: Using Docker Run (Standalone)", you might encounter errors because the entrypoint.sh file in some repositories is saved with Windows-style line endings (CRLF). Linux environments require LF. To get everything working correctly: By default, a sandbox environment is ephemeral. This means you lose your session information, such as planning results (plan.md) or research logs, once the container stops. To fix this, you need to mount the state directory from your host to the container. Add a volume mount to your docker run command for the following path:/home/agent/.local/state/.copilot An example of complete commands: Why not use the official Docker Sandbox?
Even on Mac, the current implementation of Docker Sandboxes does not support volume mounts or port forwarding. By using a standard Docker container approach on Linux (or Mac), you actually gain more flexibility in managing your data. Setting up a sandbox for GitHub Copilot CLI on Linux requires a bit of manual tweaking—specifically handling line endings and choosing a local build over the automated sandbox commands. However, the ability to mount volumes and to use port forwarding currently makes this "manual" approach superior in some use cases. Originally posted on Zenn. Templates let you quickly answer FAQs or store snippets for re-use. Hide child comments as well For further actions, you may consider blocking this person and/or reporting abuse
