Docker has launched a new product called Docker Sandboxes, designed to provide secure and isolated environments for artificial intelligence agents. The company states that these sandboxes run within dedicated microVirtual Machines (microVMs), establishing a security boundary that surpasses that of conventional containers. This development aims to address the security challenges that arise when AI agents are granted the autonomy to connect to live data, execute code, and perform actions on behalf of users.
The core of Docker Sandboxes lies in their ability to offer full agent autonomy while maintaining complete safety. Agents operating within these sandboxes can install packages, run tests, make code commits, and utilize various tools without requiring constant human oversight. This capability is crucial for agents that need to interact dynamically with development environments. Even if an agent makes an error, the consequence is contained within the microVM, preventing it from affecting the host system.
Docker Sandboxes provide a hard security boundary through microVM isolation, which goes beyond the isolation offered by standard containers. Each sandbox operates in its own virtual machine, equipped with its own Docker daemon, filesystem, and network access. This setup allows agents to build containers, install packages, and modify files without impacting the host system. Network access can be precisely controlled through allow and deny lists, restricting which external services agents can connect to. The system also supports workspace persistence, ensuring that changes made within the sandbox are synchronized with the host machine, making work continuously available.
The introduction of Docker Sandboxes is particularly relevant for AI coding agents. These agents, such as Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro, can now execute tasks unattended and experiment freely within these secure environments. This addresses a key challenge where powerful coding agents can mutate their environments by downloading packages or connecting to external services, which poses potential security risks. Docker Sandboxes aim to mitigate these risks by providing an isolated space where agents can operate with a degree of freedom without jeopardizing the host system's integrity.
The Sandboxes feature offers a familiar developer experience, maintaining the same paths, tools, and workflows as direct work on a machine. This is achieved through features like workspace mounting, which presents the project directory to the agent at the same absolute path as on the host. The system also handles Git configuration preservation for proper commit attribution. Environment variables are not inherited from the user's current shell session, further enhancing isolation.
For organizations, Docker Sandboxes can be managed centrally through Docker AI Governance. This allows administrators to set policies for sandbox network, filesystem, and other controls, ensuring uniform application across all developers' machines. This governance layer is designed to manage the risks associated with agents that can modify their environments, connect to external services, and potentially introduce security vulnerabilities.
The Sandboxes are described as disposable by default, meaning they can be quickly spun up and easily torn down after use, offering a faster alternative to traditional virtual machines. The command-line interface (CLI) for Sandboxes is free to use, including for commercial purposes, although organization governance features require a separate paid subscription.
The integration of Docker Sandboxes with platforms like NanoClaw, a secure open-source AI agent platform, further demonstrates the product's utility. This integration allows claw-based agent platforms to be deployed within Docker's microVM-based sandbox infrastructure with a single command, providing a secure execution layer for AI agents. This move signifies a shift from simply prompting AI to write code, to orchestrating teams of AI agents to build software, with Docker Sandboxes providing the secure foundation for such operations.