Docker Sandboxes

Canonical version: Docker Sandboxes.

Docker Sandboxes runs each AI agent session inside a dedicated microVM with its own private Docker daemon, isolated by the VM boundary, with no path back to the host. It exists to solve one problem: running autonomous coding agents safely. As Docker puts it, an LLM deciding its own security boundaries is not a security model. The boundary has to come from infrastructure, not from a system prompt.

Why microVMs

Docker compares four options for running agents:

• Full VMs: strong isolation, but slow cold starts and heavy overhead
• Containers: fast, but Docker-in-Docker needs elevated privileges that undermine isolation
• WASM / V8 isolates: fast startup, but can't install system packages or run arbitrary shell commands
• No sandboxing: fast, but one rm -rf or one leaked .env and the blast radius is your whole machine

MicroVMs aim to remove the usual tradeoff: VM-grade isolation with near-instant cold starts and full Docker support inside the sandbox.

Architecture

• One microVM per session: each sandbox gets its own kernel (hardware-boundary isolation)
• Private Docker daemon inside the VM: full docker build, run, and compose with no socket mounting and no host privileges
• Custom cross-platform VMM: instead of Firecracker (Linux/KVM only), Docker built its own Virtual Machine Monitor that runs natively on Apple Hypervisor.framework, Windows Hypervisor Platform, and Linux KVM
• Boundaries defined up front: which files, network endpoints, and secrets the agent gets are set before it runs; credentials are injected at runtime outside the microVM boundary
• Disposable: if an agent goes off track, delete the sandbox and start fresh in seconds, with no host state to clean up

Usage

Works with Claude Code, Codex, OpenCode, GitHub Copilot, Gemini CLI, Kiro, Docker Agent, and autonomous systems like OpenClaw and NanoClaw. Install standalone (no Docker Desktop license needed):

brew install docker/tap/sbx     # macOS
winget install Docker.sbx       # Windows

References

• https://docs.docker.com/ai/sandboxes/
• https://www.docker.com/products/docker-sandboxes/
• https://www.docker.com/blog/why-microvms-the-architecture-behind-docker-sandboxes/
• https://andrewlock.net/running-ai-agents-safely-in-a-microvm-using-docker-sandbox/
• https://www.docker.com/blog/building-ai-teams-docker-sandboxes-agent/

Related

• Docker
• AgentBox
• AI Agents
• Agentic Engineering
• Claude Code
• Strands Agents Shell
• Flue
• Vercel Sandboxes
• microVM
• OpenSandbox
• Cloudflare Sandbox SDK
• Sandcastle (AI)

About Sébastien

Ready to get to the next level?