<h2>What it is</h2>
<p>Docker Sandboxes is a standalone product that runs AI coding agents in isolated microVM environments. The pitch is simple: you can give an agent full autonomous (“YOLO”) mode permissions without worrying about what it does to your actual system.</p>
<p>Each sandbox spins up in seconds, has its own kernel, its own network, and its own Docker engine. When the task is done, it disappears. No shared state, no host access, nothing left behind.</p>
<p>It works with the agents you’re probably already using — Claude Code, GitHub Copilot CLI, Codex, Gemini CLI, Kiro — and supports both macOS and Windows. No Docker Desktop required.</p>
<h2>The security case</h2>
<p>Running agents in “dangerously-skip-permissions” mode on your host machine is genuinely risky. Prompt injection attacks are a real concern, and agents that can read your filesystem, make network calls, or talk to other agents without guardrails create a pretty wide attack surface.</p>
<p>MicroVMs are meaningfully stronger isolation than containers. A compromised container can potentially escape to the host. A microVM has its own kernel, so the blast radius is contained by design.</p>
<p>Docker has also partnered with NanoCo to support NanoClaw, a lightweight open source agent built from just 15 core source files. The small codebase is a deliberate choice — less code means less surface area for something to go wrong. Docker says this reduces the code footprint by up to 100x compared to some alternatives.</p>
<h2>How it works</h2>
<p>The CLI tool is called <code>sbx</code>. After installing it, you configure a network policy for each sandbox:</p>
<ul>
<li><strong>Open</strong> — full internet access</li>
<li><strong>Balanced</strong> — curated allowlist of common development endpoints</li>
<li><strong>Locked-down</strong> — no external network access</li>
</ul>
<p>You can create sandboxes in two modes. <strong>Direct mode</strong> gives the agent a fresh environment to work in. <strong>Branch mode</strong> uses a git worktree, so the agent works on an isolated branch of your repo without touching your working directory.</p>
<p>There’s also a TUI dashboard for monitoring what’s running.</p>
<h2>Limitations worth knowing</h2>
<p>A few rough edges to be aware of:</p>
<ul>
<li><strong>Performance overhead</strong> — microVMs are heavier than containers, so there’s a real cost compared to running agents natively</li>
<li><strong>SSH commit signing</strong> — you can’t share an SSH agent into the sandbox, so signed commits require a workaround</li>
<li><strong>Network policy gaps</strong> — the balanced policy may block documentation sites or package registries you actually need, requiring manual adjustment</li>
</ul>
<p>The network policy situation in particular seems like something that’ll need tuning in practice. “Balanced” sounds right but might be too aggressive depending on what your agent needs to fetch.</p>
<h2>The bigger picture</h2>
<p>There’s something a little unsettling about agents running autonomously at 3am while nobody’s watching — making commits, installing packages, hitting external APIs. The isolation here is a genuine improvement over the alternatives, which mostly amount to “run it on a separate machine and hope for the best.”</p>
<p>Whether the performance tradeoff is worth it depends on your threat model. For personal projects, probably not. For anything touching production code or sensitive credentials, the overhead starts to look pretty reasonable.</p>


Collections

Docker Sandboxes is a new standalone product that runs AI coding agents (Claude Code, Copilot CLI, Codex, Gemini CLI, Kiro) inside isolated microVM environments. Each sandbox has its own kernel, network, and Docker engine, spinning up in seconds and disappearing when done. The CLI tool `sbx` supports three network policies (open, balanced, locked-down) and two modes: direct and branch (git worktree). MicroVMs provide stronger isolation than containers since a compromised microVM can't escape to the host. Docker has also partnered with NanoCo to support NanoClaw, a minimal open source agent. Key limitations include performance overhead vs. native execution, SSH commit signing workarounds, and potential network policy gaps that may block needed endpoints.

Docker Sandboxes lets you run AI agents in fully autonomous mode inside isolated microVMs