The Cage

Flock launches agents at full throttle: no permission prompts, no approval dialogs. That's the point of a cockpit, and it's also a real decision to let a process loose on your machine. Secure mode resolves the tension: flip the toggle when creating a workspace and every agent in it (including later splits and spawns) runs inside a Docker container instead of on your Mac. Full permissions inside the jail; nothing outside it.

What the agent sees

Your workspace directory, and nothing else. The repo is mounted read-write at the same path as on your machine, so file paths in agent output still make sense. Git worktrees keep working.
No keys, no credentials, no host files. ~/.ssh, your keychain, cloud credentials, browser data, the rest of your disk: none of it exists inside the container.
Its own persistent home. Sign in to claude, opencode, or codex once inside the jail and the login sticks, across panes, workspaces, and restarts. If ANTHROPIC_API_KEY or OPENAI_API_KEY is set on your machine, it's passed through and no login is needed.
Your git identity. Commits made in the jail carry your user.name / user.email, lifted from your gitconfig without mounting the file itself.

Setup

Install and start Docker Desktop, the same dependency the Graph uses.
Create a workspace and enable Secure mode: jail agents in a container. The toggle tells you if Docker isn't ready.
The first secure pane builds the sandbox image right there in the terminal (a few minutes, once). Every spawn after that is instant.

Jailed panes carry a mint jailed chip in their top bar. Closing a pane tears its container down; the sandbox image rebuilds itself automatically when a flock update changes the recipe.

The honest fine print

Secure mode fails closed: if Docker isn't running, secure panes refuse to spawn. They never quietly run unjailed. Network egress stays open, because agents need their APIs, so treat the mounted repo itself as something the agent could send out. And Ctrl+C drops you to a shell inside the container, never to your Mac. The worst a rogue agent can do is trash the repo checkout, and git can undo that.