Docker Sandboxes – Disposable, isolated sandboxes for AI agents

c0rruptbytes

Reminds me of sandboxy - https://github.com/apple/containerization/tree/main/examples... Also if your thing doesn't work with `pi` out of the box, then low effort

laserlight

Requires login. Garbage.

pixard

Ah let's see, do they still want you to LOGIN, in order to use a local dev tool? Yes, yes they do. No thanks Docker. You can keep your buzzword reasoning as to why this is needed.

dSebastien

The one thing I wonder about is how you enforce the usage of Docker Sandboxes vs running the agent on the host directly, apart from scanning machines for binaries

notsirius

been using this for a while - works great! Has also had a lot of updates over the past year so worth checking out again if you tried it a while ago

blueaquilae

Docker management will fail their tech at every opportunity.

outof

Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a hard sell.

runtime_lens

TO me, that's the important distinction: sandboxing limits what the agent can do but it doesn't necessarily enforce that the agent must run inside the sandbox. You need a separate control layer to enforce that boundary.

cryptoz

The linked page implies there is no linux support, I wonder why. It's there in the docs if you hunt for it.

nezhar

Open source alternative with podman support and local telemetry collection https://github.com/VibePod/vibepod-cli

reddozen

If any AI company was doing serious engineering isolated containers would have been a prerequisite to using their tools.

alentred

I am not sure I understand, how is this different from a devcontainer or other similar techniques? On another topic, can't help but notice that "leading coding agents" somehow does not include Pi.

karakanb

I got excited for this not because this didn't exist before, but because Docker putting their weight on this would imply a broader adoption and better integration in the industry. I am sad that they are asking for a login here though, which doesn't make any sense to me.

yellow_lead

I know some people want to run their agents when their computer is off, but I imagine a solution like this will be much more common than paying for a remote sandbox (i.e on fly.io or exe.dev), especially because it'll be free. Though, they need to remove the login requirement.

meffmadd

I tried Docker Sandboxes but last time I checked you could not configure custom volume mounts, making more complex setups impossible. For work I need two directories for context for the agent to have access to…

pkhamre

I started building my own isolated and security-hardened docker image for OpenCode about half a year ago. Been using it daily. https://github.com/pkhamre/opencode-docker

Grimburger

> Each agent runs inside a dedicated microVM with your dev environment What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts? Is it marketing fluff? Incus/LXD has had VM's for a long time now. incus launch images:ubuntu/26.04 my-ubuntu-vm --vm incus exec my-ubuntu-vm -- bash

hokkos

Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes. (it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)

dannyw

I’d rather use another open source solution that doesn’t require a signup, and less likely to get rugpulled. There is no reason to require a login for creating local mini sandboxes. If you’re on Apple, native solutions like “container-machine init” come built in and are pretty good, if you’ll only be on Apple hardware.

AmazingTurtle

So it's basically a container with a fancy name, innit?