Running an agent in Docker is the starting line, not the boundary.
With Agent Zero, what actually decides what it can reach is the bridges you enable:
- where each model slot sends data (chat, utility, embedding, browser, vision)
- host file read/write (F3) and code execution (F4)
- Docker browser vs your own browser, and whose cookies
- every plugin and MCP server
List those and you've got your real boundary. Full map, checked against v2.14:
https://cryptodecentral.co.za/notes/agent-zero-container-is-not-the-boundary
#localAI
cryptodecentral / CryptoDecentral
npub10e…z384g
2026-10-16 10:56:14 UTC
Author Public Key
npub10eg6hnelz5yy65dmlmfa85j56gltc8jayayjzeqagvxml84027aq0z384gSeen on
wss://relay.primal.netPublished at
2026-10-16 10:56:14 UTCEvent JSON
{
"id": "083316352af75195ede0cab872a40d1af177f03b29c91cbe151fbb79f18a6dff",
"pubkey": "7e51abcf3f15084d51bbfed3d3d254d23ebc1e5d274921641d430dbf9eaf57ba",
"created_at": 1792148174,
"kind": 1,
"tags": [
[
"t",
"localAI"
],
[
"r",
"wss://nos.lol/"
],
[
"r",
"wss://purplepag.es/"
],
[
"r",
"wss://relay.primal.net/"
],
[
"r",
"wss://relay.nostr.net/"
],
[
"r",
"wss://relay.snort.social/"
],
[
"r",
"wss://relay.damus.io/"
],
[
"r",
"wss://nostr.mom/"
],
[
"client",
"Primal Web"
]
],
"content": "Running an agent in Docker is the starting line, not the boundary.\n\nWith Agent Zero, what actually decides what it can reach is the bridges you enable:\n- where each model slot sends data (chat, utility, embedding, browser, vision)\n- host file read/write (F3) and code execution (F4)\n- Docker browser vs your own browser, and whose cookies\n- every plugin and MCP server\n\nList those and you've got your real boundary. Full map, checked against v2.14:\nhttps://cryptodecentral.co.za/notes/agent-zero-container-is-not-the-boundary\n\n#localAI",
"sig": "62b545f8325b81919a6e5edace8285e1a94c0e8b0f70a71f240f2439b5f514811d3a7787f20b6f91282c3166d016dee7e8ae80d438aa9eddf2d50e0fc8bce91a"
}