Filesystem Isolation

Filesystem isolation in the container-use-mcp extension is achieved by integrating the Container Use Model Context Protocol (MCP) server into the Zed editor. This system provides a secure, containerized environment for coding agents, ensuring that their operations are restricted to a defined sandbox rather than the host's direct filesystem.

Sources: README.md:3-5, extension.toml:3-5

The architecture revolves around a Rust-based extension that manages the lifecycle and configuration of the cu (Container Use) binary. By acting as a bridge between Zed's internal API and the containerized server, it facilitates safe execution of agent instructions within isolated environments.

Sources: src/container_use_mcp.rs:16-18, src/container_use_mcp.rs:80-92

Binary Management and Resolution

The extension must locate the cu binary to establish the isolated environment. It follows a hierarchical resolution strategy, checking user-defined paths before searching the system environment.

Resolution Logic

1. Cached/Custom Path: Checks self.cached_binary_path which can be populated via Zed's settings.
2. System PATH: Executes a which cu command to find the binary on the host system.
3. Error Handling: If no binary is found, it directs the user to installation instructions.

Sources: src/container_use_mcp.rs:25-50, extension.toml:10-13

The following flowchart illustrates the binary discovery process:

This flow ensures that the filesystem isolation server is correctly located before any agent commands are processed.
Sources: src/container_use_mcp.rs:25-50

Configuration and Settings

Filesystem isolation is configured through Zed's standard settings JSON. Users can specify the exact location of the isolation tool to override default behavior.

Sources: src/container_use_mcp.rs:11-14, README.md:18-28

The extension utilizes schemars to generate a JSON schema for these settings, ensuring technical accuracy during configuration.
Sources: src/container_use_mcp.rs:84-86, Cargo.toml:13

Execution Environment

Once the binary is resolved, the extension spawns the cu process using the stdio communication protocol. This establishes a secure channel for the MCP server to receive instructions.

Agent Rules and Sandboxing

To enforce isolation, the system relies on specific agent rules. Users are instructed to save a .rules file in their project root, which directs coding agents to utilize the containerized environment provided by the MCP server.

Sources: README.md:30-34, configuration/installation_instructions.md:1-1

Implementation Details

The core logic is implemented in src/container_use_mcp.rs using the zed_extension_api.

Key Structs

• ContainerUseMcpSettings: Deserializes configuration for the custom binary path.
• ContainerUseMcpExtension: Maintains the state of the cached binary path.

Sources: src/container_use_mcp.rs:11-18

Critical Functions

• context_server_binary_path: Handles the filesystem lookup for the cu tool.
• context_server_command: Configures the Command struct with appropriate arguments and environment variables for the MCP server.

Sources: src/container_use_mcp.rs:21-78

The extension is registered as a library with crate-type = ["cdylib"], allowing it to be dynamically loaded by the Zed editor.
Sources: Cargo.toml:8-10

Summary

Filesystem isolation in this project is a specialized integration of the cu binary via the MCP protocol. By managing binary resolution and process spawning, the extension ensures that coding agents operate within Dagger-powered containerized environments, preventing unauthorized access to the user's host filesystem while providing a consistent development environment.