Giving sudo permissions to an agent seems reckless. Claude gets his own unprivileged UNIX account, no more. I don't bother with containers or VMs however.