Docker Releases MicroVM-Isolated Sandboxes for Unattended AI Agent Execution

Docker Sandboxes provide lightweight microVM isolation to secure local host filesystems and networks during unsupervised execution of AI coding agents. The architecture permits agents to modify configurations, install packages, and run nested containers without requiring Docker Desktop on the host.

Docker has launched Docker Sandboxes (`sbx`), a dedicated runtime environment designed to isolate autonomous AI coding agents inside microVMs. Unlike standard container-based environments, these Sandboxes establish a hard security boundary between the host operating system and the agent. Developers mount specific project workspaces into the microVM, keeping the rest of the host filesystem, network, and credentials completely isolated. This architecture is engineered to handle tasks requiring extensive privileges, such as package installation, system configuration modification, and nested container execution (running Docker within the sandbox).

Autonomy and Permissive Execution

AI agents—including Claude Code, Gemini CLI, Copilot CLI, Codex, Kiro, and OpenCode—frequently require permissive execution parameters to run effectively without continuous human intervention. Docker Sandboxes addresses this by safely enabling permissive modes, such as the `--dangerously-skip-permissions` flag (referred to as "YOLO mode").

This configuration allows agents to operate with full autonomy—unhindered by interactive permission prompts or manual reviews—while ensuring that any destructive or erroneous actions are confined entirely to the disposable microVM. Once a task is complete, the sandbox can be torn down and disposed of with a single command, keeping the host system completely untouched.

Decoupled Operation and Enterprise Governance

• Network access policies for sandbox environments
• Filesystem access controls and restrictions
• Org-wide Model Context Protocol (MCP) tool governance

Cross-Platform Deployment and Integration

The CLI tool is distributed natively across major operating systems. It also integrates with modern developer tools, such as the Warp terminal, to maintain consistent local and cloud execution environments.

Installation is handled via standard package managers: