Fleet Series 08 — gaol: the Isolation Substrate

Working notes for a planned episode — an outline, not an article. Details will shift when it gets scripted. Series index: Building the Fleet.

Deep dive on gaol (gaol-rs): the container/VM layer that makes running model-written code boring. There's a longer standalone notes page on gaol's role in the fleet — this brief is the episode shaping on top of it.

The hook

The scariest sentence in agentic coding is "and then we run the code it wrote." The fleet's answer isn't a policy document — it's a substrate: every worker gets a sandbox cheap enough to be disposable, so isolation is the default, not a ceremony.

What the viewer walks away with

• The role in one line: the TaskStore port abstracts where tasks live; the sandbox seam abstracts where code runs — gaol is what stands behind that seam
• The third governance layer: gate ("don't merge bad code"), human merge ("the line agents don't cross"), sandbox ("even bad code can't hurt you")
• The parallelism argument: fan-out that executes code is unsafe against one working copy; ephemeral sandboxes are what make N concurrent workers routine instead of a footgun
• One tool, three runtimes: Docker, systemd-nspawn, libvirt/QEMU behind one CLI/MCP surface — pick the isolation strength per job
• Fleet reach: remote exec and file ops across hosts, profiles/specs for reproducible environments, dev containers as the daily-driver case

Beats

• Open with the footgun: two agents mutating one checkout, interleaved — then the same job with ephemeral sandboxes
• The three-runtime tour: when a container is enough, when you want a VM, and why one interface matters
• The MCP angle: agents can provision their own sandboxes (create, exec, inspect, destroy) as tool calls
• Society-of-Mind kicker: sandboxed agents make the agency physically decomposed, not just logically (see the lens piece)
• Forward view: the capabilities the fleet wants next

Demo ideas

• Spin up an ephemeral sandbox, run a hostile-ish script (rm -rf the workspace), destroy it, show the host untouched
• Three concurrent workers each in their own gaol container, reconciling to one repo

Source material

• The standalone gaol-in-the-fleet notes — the whole argument, section by section
• The gaol MCP toolset (create/exec/inspect/network/remote) — live demo surface
• Day-to-day ops notes from running it as the daily dev-container substrate — texture for the "real ops" flavor

Open questions

• Adjacent-topic depth: does the audience get a nspawn/libvirt primer, or stay at "stronger walls, same commands"?