Use cases

Every use case on this section rests on the same property, so it is worth stating once: the only filesystem a kapsl-run tool ever gets is the directory you ran it in. Nothing else is mounted unless a tool's signed declaration says so, the network is off unless it is granted, and your SSH keys, cloud credentials and .env files are not on the table. That one property — the CWD is the blast radius — is what makes each of the four pages below possible, not just convenient:

• Agentic coding — an agent that shells out through kapsl can touch the checkout and structurally nothing else. The hallmark use case; the page is built around it.
• IDEs and linters — point your editor's lint and format commands at containerized tools: current, scanned, and confined to the project tree.
• CI/CD — pipelines where a CRITICAL finding fails the build, versions are a decision you make, and disk hygiene is one verb.
• Package providers — the deep dive: dependencies as declarations you can re-derive, built-in and custom providers, and what that buys you compared with Containerfiles and native package environments.

How the default posture works is on the security model page; what "scanned" means for a composed tool-plus-packages set is on the scanning page.

Pages in this section

• Agentic coding An agent that runs commands through kapsl can touch the checkout and structurally nothing else
• IDEs and linters Point your editor's lint and format commands at containerized tools — no venv, no site-packages pollution
• CI/CD Pipelines where a CRITICAL finding fails the build, versions are a decision, and disk hygiene is one verb
• Package providers Dependencies as declarations you can re-derive: the built-in registry, custom providers, and what that buys you