My custom harness has a dagger based environment, binary runs in the host, every tool call and file modification creates a new layer in a container - for better session time travel and forking

It may work for some things, but you really want to be wired into that system to do the more interesting things.