← Back to feed

Docker has shipped a dedicated isolation product for AI coding agents, available now on macOS and Windows. Each sandbox gives an agent a dedicated microVM with its own Docker daemon, filesystem, and network — agents can install packages, modify configs, and spin up containers within the sandbox without touching the host machine. When the session ends, the sandbox is discarded.

The product is named Docker Sandboxes and is distributed through Docker’s own package tap. On macOS: brew trust docker/tap && brew install docker/tap/sbx. On Windows: winget install Docker.sbx.

The Problem It Solves

Every major AI coding agent ships with a bypass mode for permission prompts. Claude Code has --dangerously-skip-permissions. Gemini CLI, Codex, and Kiro have equivalents. These modes are necessary for unattended autonomous work — stopping to ask permission on every tool call defeats the purpose of an agent — but they expose the host machine to whatever the agent decides to do.

The conventional workaround has been ad hoc: developers spin up a VM, use a Docker container, or accept the risk on a dedicated machine. Docker Sandboxes standardizes that workaround into a product layer. The sandbox is the container, but unlike a standard Docker container the agent gets a full Docker daemon of its own, so it can spin up its own containers without hitting the Docker-in-Docker security wall.

Architecture

Each Docker Sandbox is a microVM, not a container. The distinction matters: containers share the host kernel and can escape through kernel exploits; microVMs run a separate lightweight kernel, giving a hard security boundary. The agent’s workspace is mounted in; nothing else from the host is accessible by default.

Network and filesystem controls are configurable. Docker AI Governance allows organizations to enforce consistent sandbox policies across teams — setting what agents can reach on the network and what paths they can write to — without requiring per-developer configuration.

Anthropic, Google, Microsoft (via Copilot CLI), OpenAI (via Codex), and the Kiro and OpenCode teams all have launch integrations. The product’s default mode is --dangerously-skip-permissions inside the sandbox, which is deliberate: Docker’s position is that agents should have full autonomy within the boundary, and the boundary should be the thing you trust.

Timing

The launch lands the same week Anthropic announced Claude Code will default to autonomous auto mode on August 14. The two announcements together mark a direction: coding agents are being given more operating freedom at the product layer, and the infrastructure layer is building the containment structures to make that safe at scale.

Docker’s commercial play is Docker AI Governance — centralized policy enforcement for organizations running agents across many developers. The sandbox CLI itself is the free entry point; governance is the enterprise product.

Key Facts

• Isolation: microVM per session, own Docker daemon, isolated filesystem and network
• Supported agents: Claude Code, Gemini CLI, Copilot CLI (Microsoft), Codex (OpenAI), Kiro, OpenCode
• Default inside sandbox: --dangerously-skip-permissions (full agent autonomy within boundary)
• Enterprise layer: Docker AI Governance for org-wide policy enforcement
• Disposable: sandbox destroyed after session, no persistent state by default
• Install: brew trust docker/tap && brew install docker/tap/sbx (macOS); winget install Docker.sbx (Windows)