Local LLMs are useful for proposing code changes, but giving one direct shell or Docker access to a real application is a bad trade: a model with ordinary tool access can turn any prompt into a live mutation. I wanted the model's help maintaining a real self-hosted Docker application without ever letting it make that mutation happen on its own.
A Windows broker/actuator pair sits between the model and the live container. The model proposes a change through an MCP tool surface; the broker builds and tests a candidate image in isolation, and the actuator is the only component with any authority to touch the running container -- and only after a durable capability has been explicitly issued for that one action. The model runs under a restricted account with filesystem confinement, so even a compromised or misbehaving model has no path to production that doesn't go through the broker.
Every promotion requires a literal human "allow once" -- no standing authority, no batch approvals, one capability per mutation. Before that, the candidate goes through checkpointing and baseline verification so a rollback target always exists; after promotion, a health watchdog monitors the container and automatically rolls back on failure signals (crash-looping, restart-count thresholds, or sustained unhealthy status), capturing a diagnostic bundle before it does. The system fails closed by design -- if a check can't be verified, the action doesn't happen.
Each change runs a gated pipeline: pre-flight tests against a real containerized copy of the app before any full build, an automated behavioral test suite that has to pass on both the candidate and the promoted image, a same-response code review step using the actual applied diff, and only then the human approval gate. The pipeline itself is covered by an automated test suite in the hundreds of tests, and I've hardened it repeatedly.
The operator has completed real, code-bearing promotions to a live Docker application on real human approval, including a genuine multi-file feature shipped end-to-end. Deliberately broken candidates have been driven through the watchdog into automatic rollback and verified restoration multiple times, and a full deny cycle has also been proven. The application has stayed healthy through every cycle -- no mutation has ever reached it without going through the full gate.
Separating what the model proposes from what it's authorized to do turned out to be the single most important discipline in this project. Nearly every real bug I found wasn't in a model's proposed change -- it was in the guardrails meant to constrain it, which is where the real risk always lives.