Kubernetes + GitHub Copilot,
safely isolated

Spin up a read-only kubeconfig and run GitHub Copilot CLI
in an ephemeral container — zero credentials left behind.

Creates a scoped ServiceAccount with get/list/watch on all resources — secrets never included.

All RBAC resources and the kubeconfig are deleted automatically when you exit.

Pre-built for linux/amd64 and linux/arm64. Signed with cosign.

Auto-detects the container runtime. Works with both Docker and Podman.

Install via brew tap or kubectl krew. Pre-built binaries for all major platforms.

Use -i to interactively configure image, network mode, volumes, and entrypoint.