AI coding agents face an awkward contradiction: to be useful, they need full permission to edit files, install packages, and run commands; to be safe, none of those permissions should be handed out casually. Docker’s answer is to make it a product. Sandboxes is now generally available, using disposable microVMs to fence off a safe zone for agents like Claude Code and Codex. The official positioning fits in one line: “disposable, isolated sandboxes for AI agents that need safe, unattended execution.”
The launch thread climbed to hundreds of points on Hacker News, and the interest points to a real shift: agents are turning from tools that give advice into colleagues that act. The biggest psychological barrier for developers is no longer model capability — it is whether they dare to let the agent run loose.
The Problem: The Permission Paradox
An agent only earns its keep by doing real work: installing dependencies, changing config files, starting local services, running tests. Doing all of that directly on a developer machine means handing over every corner of the host, so many users simply flip on “YOLO mode” and skip all permission prompts. Docker’s product page puts it plainly: the question is not whether to skip permissions, but how big the blast radius is when you do.
The named audience — agents that need “safe, unattended execution” — is the overnight-job scenario: hand the agent a task, let it install dependencies and run the test suite, and come back to a diff. It is precisely the scenario where nobody is watching the prompts.
How It Works: One microVM per Agent
The unit of isolation is a microVM. Each sandbox gets its own Docker daemon, filesystem, and network; the host mounts in only the project workspace, and a “hard security boundary” separates the two. Inside the sandbox, an agent can install packages, modify settings, and even spin up containers of its own — whatever it does, the rest of the host stays untouched. That last capability matters more than it sounds: agents that build and test containerized apps need to run Docker themselves, and Sandboxes lets them do it without giving them the host daemon. Filesystem, network, and credentials can each be governed by separate policies.
The supported agent list covers Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro, with custom agents supported too.
Three Commands to Get Started
Installation covers all three major platforms: brew on macOS, winget on Windows, apt on Ubuntu. After signing in, run sbx run claude from a project directory and the agent starts inside its sandbox. Notably, Docker Desktop is not required — a clear nod to CI and server use cases. Advanced configuration includes credentials management, declarative project environments, GPU passthrough, and an upstream proxy, and Docker tracks releases and feedback in a public sbx-releases repository.
The Business Model: Free CLI, Paid Governance
Individual use is entirely free, including commercial use. What costs money is organizational governance: through Docker AI Governance, admins can centrally enforce sandbox network, filesystem, and MCP policies across every developer machine in an organization. It is a smart cut — individual developers adopt with zero friction, and once the habit forms, enterprise governance becomes the natural conversion point.
What It Means for AI Coding Workflows
Two signals here. First, sandboxes are moving from “build your own” to “ship with the desktop”: Warp is integrating Sandboxes, and its engineering lead Ben Navetta says the goal is letting developers “run agents freely with a consistent environment,” while NanoClaw creator Gavriel Cohen calls it the answer “at the infrastructure level.” Second, the risk model for unattended execution has changed: when the blast radius shrinks from “your machine” to “one disposable VM,” letting an agent run long tasks overnight gets much easier to accept. For product teams, the question is no longer “should agents get a sandbox” but “what does your sandbox policy look like.”
There is also a quieter strategic read. A CLI that slots in next to existing Docker tooling turns adoption into a configuration change rather than a new-runtime decision — and for teams already living in containers, that is the easiest kind of infrastructure shift: the one that arrives inside a tool you already run every day.
Sources
- Docker Sandboxes — Sandboxes for Coding Agents
- Docker Sandboxes documentation — Docker Docs
- Docker AI Governance — Docker
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.