Without a jail, a coding agent runs as you: it can open sockets, read ~/.ssh, talk to 169.254.169.254, and follow workspace symlinks onto the host. A jail puts a kernel boundary around that process so those paths fail closed unless a separate control plane allows them.
Fleet's jail for Fleet-launched Linux agents combines user, mount, PID, and network namespaces. The host inference broker owns model keys. Default-deny networking means an unknown host does not get a socket; the agent waits. Workload, MCP, and in-sandbox callers cannot approve that wait. A human grant enables traffic to that host for a bounded window, then the relay closes.
Prove it on Linux: run fleet doctor, then go test -count=1 -run TestAcceptance_CompromisedAgentHasNoAlternateEgressPath ./internal/sandbox/. A passing transcript prints TCP_DENIED through CHILD_SECRET_DENIED. If the process needs a host, the run parks until you allow that host. Grok Bot, Cursor Cloud, and Codex cloud VMs run on their vendors.