Background

PR #394 proposed mounting the host filesystem as read-only for improved security, with an isolate.sh utility to run host binaries via chroot when not available in container PATH.

Proposed Changes

1. Read-only host mount: Change default mount from /:/host:rw to /:/host:ro in docker-manager.ts
2. isolate.sh script: Add to agent container at /usr/local/bin/isolate.sh
   • Falls back to chroot into /host when binary not found in container PATH
   • Handles both absolute paths and relative commands
   • Validates /host exists before chroot attempt
3. Automatic command wrapping: Modify entrypoint.sh to wrap all user commands with isolate.sh

Security Benefits

• Prevents accidental or malicious writes to the host filesystem
• Maintains ability to execute host binaries when needed

Issue created from PR #394 during backlog cleanup