Run Cursor agent mode safely with containers and hooks

The poster runs Cursor agent mode on a real project, including a Twilio voice agent, using containers, hooks and safeguards to protect the environment.

What They Did

The poster runs Cursor agent mode inside a per-feature devcontainer with Docker Compose services for the app, Postgres, Redis, and a Cloudflared sidecar, plus forwarded ports for a Twilio voice agent’s web UI and websocket endpoint. Secrets are injected from a dedicated 1Password vault, while destructive actions stay behind host SSH agent biometric approval, so the agent can use CLI commands and work autonomously but can’t safely touch main or the host environment.

How It Went

The result was a setup where they could leave Cursor running on real tasks and either return to finished work or delete a broken container with no damage outside that isolated stack. It still needed extra safeguards beyond Cursor’s built-in protections, and Cloudflare Bot Fight Mode had to be disabled for some ChatGPT-facing use cases.

Worth Knowing

Their main practical catch is that each feature gets its own isolated containerized environment, and if the agent breaks it, they simply throw the container away and start fresh.