7 ms·

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

• zuzululu 2mo ago
  smolvm is also great too
• pixard 2mo ago
  Ah let's see, do they still want you to LOGIN, in order to use a local dev tool? Yes, yes they do. No thanks Docker. You can keep your buzzword reasoning as to why this is needed.
• outof 2mo ago
  Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a hard sell.
  • zingar 2mo ago
    Were you following any patterns/standards/advice on what you needed to protect against? Anything you can point the rest of us to?
    • embedding-shape 2mo ago
      You want to prevent the agent/others from reaching your home directory and other things. As long as you don't mount/sync directories/files from/to the container, so no mounting like "-v $(pwd):/app", but instead copy in, then when done, copy out. And of course, instead of doing the "copy in > copy out" process manually, get your local agent to write a bash script that does that for you, given what directory you're in, and you're basically G2G.
      • tjoff 2mo ago
        What is the advantage of copying rather than a bind-mount?
        • furst-blumier 2mo ago
          "Oops I deleted everything under $FOLDER – that mistake is on me" doesn't kill it on your host system
          • tjoff 2mo ago
            Sure, but all projects are version controlled? You only mount the project dir so you can only loose your current changes - which is the same if you copy...
    • hvb2 2mo ago
      What specifically are you looking for? If you start from the premise that it runs as you right now, then that's something you can easily improve upon. Start by mounting just your repo and passing in the keys for the agent. Take it from there, it's like software engineering, you iterate. When you run into issues you expand the tools in the container available to it.
    • matheusmoreira 2mo ago
      > Were you following any patterns/standards/advice on what you needed to protect against? Just the general knowledge that sharing a kernel with untrusted software is too dangerous, that hardware virtualization is an infinitely smaller attack surface and that the entire industry will be in deep shit if people or AI breaks hypervisors. Initial threat model was supply chain attacks but eventually grew to include AI harnesses as well. Not very worried about them hacking me, more about accident prevention. So that means each VM must be running a completely independent kernel that's fully isolated from the host's file system. They must also have fail closed network filtering built in. > Anything you can point the rest of us to? I have published my virtdev's design document. https://github.com/matheusmoreira/virtdev/blob/master/DESIGN.md https://github.com/matheusmoreira/virtdev/blob/master/DESIGN... Yes, it is AI generated. In summary, it's a QEMU VM orchestrator with a base OS image and project specific delta images. VM lifecycle is managed by systemd. System level isolation is already pretty good and it already solves the "AI wiped out my $HOME" problem. I'm currently working on a custom network stack to replace the nftables based firewall.
  • KolibriFly 2mo ago
    [dead]
  • matheusmoreira 2mo ago
    I did the same thing. It was my first "vibecoded" project. I've been using it every day and it's great. I'm writing a custom Rust network stack for it right now. Gonna replace the current nftables firewall with it. As for Docker Sandboxes, I'll just ask Sol literally right now to see what it does better than my virtdev, and then I'll improve virtdev instead of using Docker.
  • rvz 2mo ago
    Why developers will never pay for their tools.
• c0rruptbytes 2mo ago
  Reminds me of sandboxy - https://github.com/apple/containerization/tree/main/examples/sandboxy https://github.com/apple/containerization/tree/main/examples... Also if your thing doesn't work with `pi` out of the box, then low effort
  • ucyo 2mo ago
    Just put the following to your `.config/sandboxy/agents/pi.json` { "allowedHosts": [ ".anthropic.com", ".claude.com", ".pi.dev", "npm.org", ".npmjs.org", ".github.com", ".githubusercontent.com", ".pypi.org", ".pythonhosted.org" ], "baseImage": "docker.io\/library\/node:22", "displayName": "Pi", "environmentVariables": [ "IS_SANDBOX=1" ], "installCommands": [ "npm install -g --ignore-scripts @earendil-works/pi-coding-agent", "npm install -g global-agent" ], "launchCommand": [ "pi" ], "mounts": [ { "containerPath": "\/root\/.pi", "hostPath": "~\/.pi", "readOnly": false } ] }⏎
• laserlight 2mo ago
  Requires login. Garbage.
  • Alifatisk 2mo ago
    What? Does using sbx require login? Bummer.
    • dSebastien 2mo ago
      Yes and they have a specific subscription for managing sandbox policies across the enterprise: Docker AI Governance
      • dSebastien 2mo ago
        You can create those manually but if you want to enforce those then you need the subscription
  • binsquare 2mo ago
    I build a OSS lightweight, portable VM for those that don't want lock ins: https://github.com/smol-machines/smolvm https://github.com/smol-machines/smolvm
    • nicoty 2mo ago
      I have a solution based on Nix that can be used to generate reproducible container images: https://github.com/nothingnesses/agent-images https://github.com/nothingnesses/agent-images . It lets you customise which agents, harnesses, or any other packages you want included in the VM and it uses `agent-box` for sandboxing.
      • binsquare 2mo ago
        wonderful, will try to test this in smol machines as well
    • dizhn 2mo ago
• dSebastien 2mo ago
  The one thing I wonder about is how you enforce the usage of Docker Sandboxes vs running the agent on the host directly, apart from scanning machines for binaries
• notsirius 2mo ago
  been using this for a while - works great! Has also had a lot of updates over the past year so worth checking out again if you tried it a while ago
  • zingar 2mo ago
    Do the agents come preinstalled in the images? Or do they somehow use whatever I’ve installed locally? The former makes sense to me but then I’m wondering whether the sandbox images stay up to date with new releases of each image.
    • aborsy 2mo ago
      The agent is per installed. If there is an update to the agent, the VM notifies you on a first run and updates it if you approve. Other than the login problem, it’s a decent option.
    • notsirius 2mo ago
      Sometimes is up to date. When its not - you can just use a kit and add command: install : codex update https://docs.docker.com/ai/sandboxes/customize/kits/ https://docs.docker.com/ai/sandboxes/customize/kits/
• blueaquilae 2mo ago
  Docker management will fail their tech at every opportunity.
• kmeh 2mo ago
  [dead]
  • jbellis 2mo ago
    Why less workflow friction?
    • kmeh 2mo ago
      Customize the exact environment of your container from the ground up (harnesses, tools, base image, packages, mounts, etc) and enter with a single command.
  • solarengineer 2mo ago
    There is a name collision on MacOS where MacOS also provides containers [1] [1] https://github.com/apple/container https://github.com/apple/container
• runtime_lens 2mo ago
  [flagged]
  • nezhar 2mo ago
    You design the sandbox so the agent starts in that layer. The next thing you can do is to limit the network access, this is what I'm working on right now. Or do you mean something else?
    • runtime_lens 2mo ago
      [flagged]
• songhonglei1985 2mo ago
  [dead]
• cryptoz 2mo ago
  The linked page implies there is no linux support, I wonder why. It's there in the docs if you hunt for it.
  • etoxin 2mo ago
    The docs are here: https://docs.docker.com/ai/sandboxes/ https://docs.docker.com/ai/sandboxes/ The other url is their marketing page. Yes, Linux is supported.
• nezhar 2mo ago
  Open source alternative with podman support and local telemetry collection https://github.com/VibePod/vibepod-cli https://github.com/VibePod/vibepod-cli
  • biehl 2mo ago
    Looks really nice. Would it be easy to make a qwen-cli wrapper?
    • nezhar 2mo ago
      Sure, I added an issue for this, so it will follow in one of the next releases
  • codethief 2mo ago
    This is not really an alternative if you care about the security of your host system. Docker Sandbox uses micro VMs for a reasons.
• reddozen 2mo ago
  If any AI company was doing serious engineering isolated containers would have been a prerequisite to using their tools.
  • globular-toast 2mo ago
    Anyone serious about security will want to bring their own sandbox anyway, not trust these, often proprietary, agents. I've never run an agent outside a sandbox. My first bubblewrap script for `claude` is now over a year old. The tools are available and if you learn to use them you can run any program in a sandbox. But, in any case, why put in effort doing something people don't expect or ask for? We can assume everyone running agents is either a) using their own sandbox, or b) doesn't care. I think we can guess which category most people fall into. You could maybe argue about responsibility, but I don't think you can argue about "serious engineering".
    • topspin 2mo ago
      > Anyone serious about security will want to bring their own sandbox anyway Exactly. It's not as though it's difficult. It never occurred to me to not do this from day one, and it astonishes me that anyone runs this stuff bare metal. Since then, I've brought several other people on board, and that's all they've ever seen: I don't think they'd know how to run outside a sandbox, and that's just fine.
    • reddozen 2mo ago
      > why put in effort doing something people don't expect or ask for? True! Why did we bother with devcontainers anyway? Who asked for permissions on tool calls? Only those weird security people care about putting whats effectively a CNC rootkit inside a sandbox. Its not about seriously protecting the user against our AI slop inevitably typing `rm -rf work /` and deleting their entire drive.
• alentred 2mo ago
  I am not sure I understand, how is this different from a devcontainer or other similar techniques? On another topic, can't help but notice that "leading coding agents" somehow does not include Pi.
  • zmmmmm 2mo ago
    it's running a full VM so the agent can eg: run docker commands safely etc
  • alexfortin 2mo ago
    About the missing native support for Pi, I opened this issue long ago in case you want to add some pressure: https://github.com/docker/sbx-releases/issues/34 https://github.com/docker/sbx-releases/issues/34 To work around that limitation I came up with this https://github.com/shaftoe/sbx-template-pi https://github.com/shaftoe/sbx-template-pi So essentially you can get latest Pi/Node pulling from that image: `sbx run -t ghcr.io/shaftoe/sbx-template-pi:latest shell` Like others here I'm also saddened by the login requirement but at the moment this is the best UX I could find for running sandboxed agents, the "kit/mixin" concepts are neat and I make use of them too: https://github.com/shaftoe/sbx-template-pi#stacking-the-extras-mixin https://github.com/shaftoe/sbx-template-pi#stacking-the-extr...
• karakanb 2mo ago
  I got excited for this not because this didn't exist before, but because Docker putting their weight on this would imply a broader adoption and better integration in the industry. I am sad that they are asking for a login here though, which doesn't make any sense to me.
  • KolibriFly 2mo ago
    That's docker, man. Tomorrow they're gonna add limits on sandbox runs without a premium account too
  • rvz 2mo ago
    microVMs (firecracker) have existed for years. This is not new.
• deleted 2mo ago
  [deleted]
• yellow_lead 2mo ago
  I know some people want to run their agents when their computer is off, but I imagine a solution like this will be much more common than paying for a remote sandbox (i.e on fly.io or exe.dev), especially because it'll be free. Though, they need to remove the login requirement.
  • dbmikus 2mo ago
    Agreed! I think the best user experience is: 1. You can run sandboxes locally 2. You can control them securely over the internet, for when you're on the go 3. You can migrate them to cloud VMs if you want If I can toot my own horn, I'm trying to build that :) Still early and the local sandboxes are experimental right now https://github.com/gofixpoint/amika https://github.com/gofixpoint/amika
• meffmadd 2mo ago
  I tried Docker Sandboxes but last time I checked you could not configure custom volume mounts, making more complex setups impossible. For work I need two directories for context for the agent to have access to…
  • cyberpunk 2mo ago
    put them both inside another directory and share that? what am i missing?
    • meffmadd 2mo ago
      Of course, but that was not part of my workflow and I found it quite strange that this was simply not possible especially when docker-compose can easily do this
  • deleted 2mo ago
    [deleted]
  • mikesir87 2mo ago
    When starting a sandbox, you can specify the mountpoints you want. It just defaults to the current directory. You can also specify some of those mounts as read-only as well. Example: sbx run claude ./ ../another-project:ro
  • notsirius 2mo ago
    This was added recently https://docs.docker.com/ai/sandboxes/usage/#multiple-workspaces https://docs.docker.com/ai/sandboxes/usage/#multiple-workspa... ` sbx run claude ~/project-a ~/shared-libs:ro ~/docs:ro`
• KolibriFly 2mo ago
  [dead]
• pkhamre 2mo ago
  I started building my own isolated and security-hardened docker image for OpenCode about half a year ago. Been using it daily. https://github.com/pkhamre/opencode-docker https://github.com/pkhamre/opencode-docker
  • dejw 2mo ago
    if I was paranoid about security I wouldn't use docker in the first place.
• Grimburger 2mo ago
  > Each agent runs inside a dedicated microVM with your dev environment What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts? Is it marketing fluff? Incus/LXD has had VM's for a long time now. incus launch images:ubuntu/26.04 my-ubuntu-vm --vm incus exec my-ubuntu-vm -- bash
  • frio 2mo ago
    It’s real VMs, firecracker style.
    • Grimburger 2mo ago
      Haven't used docker sandbox but you can't just `apt install postgres` on firecracker, it needs to get baked into the image first. That's my experience anyway, there's a lot of restrictions once you need to do some real basic things. For basic prompts maybe but interacting with a full stack ehh. So bit hesitant to call firecracker a real VM myself.
  • dizhn 2mo ago
    That's a full VM. Microvms are much smaller and they start up very very fast. In miliseconds.
  • randomint64 2mo ago
    [dead]
  • masklinn 2mo ago
    “microvms” are real vms but the hypervisor and vm (guest kernel) shed most of the hardware / device emulation, support, and discovery which makes traditional VMs look / feel like real computers, as well as most guest interactions. This gives them extremely low overhead. Firecracker is designed to start a VM in under 125ms and 5MB. Netbsd advertises that you can direct-boot a MICROVM kernel configuration in under 10ms.
    • jsiepkes 2mo ago
• hokkos 2mo ago
  Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes. (it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)
  • crabmusket 2mo ago
    There's always https://github.com/mensfeld/code-on-incus https://github.com/mensfeld/code-on-incus
  • stefanka 2mo ago
    What about bubblewrap? It also provides a sandbox
    • SwellJoe 2mo ago
      Yes, bubblewrap is superior to Docker for this. I wrote a tool to use bubblewrap for the purpose. It needs a tool to start it, or is at least much more convenient with a tool, because you need to take your session/auth data into the container, and if you want the agent to be able to start containers (agents love containers) within the container, you need some config magic mounted inside. You could manually do all that, or do it with a shell script, as well. But, this is how I did it, and you're likely to run into all the same little quirks I ran into: https://github.com/swelljoe/flar https://github.com/swelljoe/flar
      • stefanka 2mo ago
        Interesting. I’ve been trying to use bwrap, slirp4netns, and mitmproxy to create a simple Python script to get save shell for development. But it’s a huge time sink (and I might resort to podman)
  • ai_fry_ur_brain 2mo ago
    [dead]
  • ethagnawl 2mo ago
• beernet 2mo ago
  [flagged]
• dannyw 2mo ago
  I’d rather use another open source solution that doesn’t require a signup, and less likely to get rugpulled. There is no reason to require a login for creating local mini sandboxes. If you’re on Apple, native solutions like “container-machine init” come built in and are pretty good, if you’ll only be on Apple hardware.
• AmazingTurtle 2mo ago
  So it's basically a container with a fancy name, innit?
• navigate8310 2mo ago
  I just made my own devcontainer that I copy on any project and load whatever harness I want in that repo. Harnesss' config and auth are simply mounted from the host, so no setup required at all. https://github.com/iodize6399/ai-devcontainer/tree/main/.devcontainer https://github.com/iodize6399/ai-devcontainer/tree/main/.dev...
  • ai_fry_ur_brain 2mo ago
    [dead]
  • anentropic 2mo ago
    Yeah I also recently started using devcontainers for this I quite like the 'features' layer system, adding extra tools to container in a declarative plugin-like way Being able to 'safely' run with skip permissions has been a gamechanger
  • cvak 2mo ago
    yeah, I actually just re-use claude-code .devcontainer: https://github.com/anthropics/claude-code/tree/main/.devcontainer https://github.com/anthropics/claude-code/tree/main/.devcont... I especially like the firewall it has.
    • fg137 2mo ago
      I don't get how it works, or works well -- presumably those domains are behind CDNs, and IP addresses are unpredictable. So the firewall allows traffic to specific IPs that are resolved at the time the script is run, but not after that? What if the same domain is resolved again without going through the cache, and it becomes a different IP? And even if that works, this is a very short list. As soon as you reach for Go, Rust tooling etc nothing works. So you need to manually maintain this list which is nothing but painful trial and error.
  • deleted 2mo ago
    [deleted]
  • deleted 2mo ago
    [deleted]
• navigate8310 2mo ago
  Here's another sandbox that I found interesting: https://github.com/ashishb/amazing-sandbox https://github.com/ashishb/amazing-sandbox
  • _pdp_ 2mo ago
    Very interesting. Thanks for sharing.
• bob1029 2mo ago
  The sandboxing problem is perhaps the greatest justification for doing agent integration via existing human interfaces rather than low level shell access. Granting access to shell is a super obvious path (it's easy) so I can understand us wanting to fight for it. But we should consider the other paths as well before we make our final stand. Automating browsers with LLM agents properly requires a lot more work than Process.Start into powershell, but the advantages can be immense once you have achieved integration this way. Incrementally maintaining this integration is generally easy because human users cannot tolerate rapid changes either. It's a hell of a lot easier to convince management to adopt a robot that looks and acts like a human employee than one that looks like a combine harvester. The combine is far more efficient, but it is also totally indiscriminate. Nothing constrains its appetite except for the invisible fence imposed by GPS. The amount of infrastructure required to keep farm equipment from running astray is incredible. In the context of agriculture, the added complexity is definitely worth it. We don't want to have to recreate the same thing with our technology if it can be avoided. Sandboxes and security isolation boundaries are not things to aspire to. These are costs to be paid for admission to something more valuable.
• Schlagbohrer 2mo ago
  Can someone more versed in Docker explain to me how this is different than building my own docker container from a Dockerfile for using Pi agent harness? That's what I do currently. I use Docker Desktop in windows as the backend for that.
  • Hugsun 2mo ago
    Docker containers use Linux kernel features to create an isolated environment, running on the same machine as docker is. This creates a virtual machine, with its own kernel, and runs the container in there. This gives stronger isolation and security guarantees.
    • eloisius 2mo ago
      I have the same question as GP. Your answer helps a little but not really. I might be naive, but I was under the impression that malicious code escaping a docker image and running amok on my host system was not something I should be too worried about. Especially if I run docker in rootless mode. Is that wrong? For clarity I’m actually using podman, not Docker.
      • angry_octet 2mo ago
        Oh no, you should definitely be worried about that. Podman might make it harder to escalate to host root, or manipulate other containers, but it is still vulnerable. Now I'm curious to know how hardened the Docket Sandbox orchestration interface is. I guess we can assume they have run Mythos against it for a few weeks maybe? It's unclear.
        • eloisius 2mo ago
          Unsettling. I mean, is there any reasonable way to develop software in 2026? I've already sworn off ever installing npm directly on my host. Containerizing everything is laborious enough, but running a separate VM for everything?
• TekMol 2mo ago
  So this is a VM by Docker? For those who do not trust docker run --rm -it -v "$(pwd)":/work -w /work myaiimage /bin/bash AND do not want to use some other, free VM for some reason?
  • pulse7 2mo ago
    Hasn't Docker always been just a thin layer of duct tape over existing solutions?
  • woadwarrior01 2mo ago
    Better yet, use Apple's container CLI if you're on a Mac, instead of the docker bloatware. container run --rm -it -v "$(pwd)":/work -w /work myaiimage /bin/bash
• rusch 2mo ago
  The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondolin https://earendil-works.github.io/gondolin but the DX is not as polished. https://exe.dev/ https://exe.dev/ would be perfect but it does not come with outbound firewall. Does anyone have a better alternative?
  • SegmentTree 2mo ago
    Eclipse Enclave does exactly that: There is an outbound firewall and secret injections, so that the agent never sees a real key. And it's fully open source: https://github.com/eclipse-enclave/enclave https://github.com/eclipse-enclave/enclave
    • dvtkrlbs 2mo ago
      Looking at the Readme it seems like it only supports docker. Which is a dealbreaker for some
      • collabs 2mo ago
        What is missing in qemu + podman that we need rootful docker for this? Is there actual capability that is missing or is it more of a design choice by the eclipse enclave folks?
  • deleted 2mo ago
    [deleted]
  • _ink_ 2mo ago
    Does secret injection really prevent that the agent send my GitHub key somewhere? If it has access to it via env var, can it not just paste it somewhere?
    • 2mo ago
• globular-toast 2mo ago
  On Linux, you can skip Docker and use bubblewrap. Some inspiration: https://blog.gpkb.org/posts/ai-agent-sandbox/ https://blog.gpkb.org/posts/ai-agent-sandbox/
  • angry_octet 2mo ago
    Bubble wrap is just containerisation no?
    • globular-toast 2mo ago
      Not sure what you mean by "just". Containerisation is generally understood to mean something like what Docker does, which includes sandboxing but a whole lot more on top, like image management etc. Bubblewrap is just sandboxing without the rest of containerisation.
      • mihaelm 2mo ago
        Docker Sandboxes is using microVMs, not containerization.
        • globular-toast 2mo ago
          That's an implementation detail. They do that because less capable OSes don't have direct support for sandboxes.
          • angry_octet 2mo ago
            No, that's not why.
• deleted 2mo ago
  [deleted]
• deleted 2mo ago
  [deleted]
• nopurpose 2mo ago
  Most interesting part to me is credentials injection at the sandbox boundary level: https://docs.docker.com/ai/sandboxes/security/credentials https://docs.docker.com/ai/sandboxes/security/credentials
  • quotemstr 2mo ago
    Doesn't everyone do this now? It's hardly a new idea. Yet every time someone proposes the idea, people fawn over it and proclaim it the best thing ever. Yes, you can inject tokens via a proxy. What else is new?
    • nopurpose 2mo ago
      Who is doing it as first class feature with at least adequate UX? I have skimmed alternatives offered in comments to this post (vibepod-cli, code-on-incus, opencode-docker, sandboxy, smolvm, amazing-sandbox) and none of them seem to do credentials injection at the proxy level.
      • LeBit 2mo ago
        nono. Also fnox now does credentials proxying.
        • nopurpose 2mo ago
          Thanks, bookmarked nono to have a look later.
• sureglymop 2mo ago
  What is the main benefit over doing something like: docker run --runtime krun --rm -it -v $(pwd):/workspace/$(basename $(pwd)) -w /workspace/$(basename $(pwd)) --network restricted-net ghcr.io/openai/codex-universal:latest sh That runs the codex OCI in a qemu microvm. From what I can see, more fine grained network and filesystem access control as well as convenience?
  • mdavidn 2mo ago
    Aside from hiding agent credentials from the agent, it also runs an isolated Docker Engine for the agent to use freely.
  • defraxi 2mo ago
    The credentials part... https://docs.docker.com/ai/sandboxes/security/credentials/ https://docs.docker.com/ai/sandboxes/security/credentials/
    • ShinyLeftPad 2mo ago
      It seems to do a good job of not stating the actual threat model anywhere.
  • codethief 2mo ago
    Yes, pretty much, except for one detail: > That runs the codex OCI in a qemu microvm. AFAIU it's actually the other way around: krun spawns a libkrun-based (not QEMU-based) VM inside a crun container. Source: https://github.com/libkrun/libkrun/discussions/538#discussioncomment-15765542 https://github.com/libkrun/libkrun/discussions/538#discussio... So with your solution you get the additional security benefit of containerizing the hypervisor on the host.
    • figmert 2mo ago
      Once you have a vm, the container provides next to no additional security benefits. It's just unnecessary overhead at that point.
• 3371 2mo ago
  I used this for a while then decided to build my own suites that pack individual harness and respective host state (config, plugins, skills, etc.) into an image. Works better and much flexible in my opinion.
• devttyeu 2mo ago
  I did try to use those for some stuff: * Login requirement is something else * It's closed source last I checked * Pretty slow/unstable There are many better namespace/container based options, VMs may be moderately more secure but when you more or less trust your agent and code you can do with lesser containment. And with the recent CVEs in kvm honestly there isn't a huge deal of difference vs namespaces. (I'm building https://xbin.dev/ https://xbin.dev/ for some time now for managing my personal code/apps, a project which started specifically after Docker Sandboxes broke on me some time ago)
• elAhmo 2mo ago
  I wish they solved the issue happening for years on MacOS where Docker keeps up eating all available free space and ends up requiring restart of the whole machine, instead of Gordon and other useless shit.
• freakynit 2mo ago
  Has anyone tried https://bhatti.sh/ https://bhatti.sh/ ?
  • sahil-shubham 2mo ago
    Hey, creator of bhatti here, let me know if you any questions.
    • freakynit 2mo ago
      great product.
• weinzierl 2mo ago
  Before you use no sandbox at all use this or one the many similar projects but it's alway worth remembering that Docker is not a security boundary. It never has been meant to be and never will become one. cgroups are a mechanism designed for hierarchical organization and resource distribution. Against a malicious and capable actor, and that is how we have to treat AI agents, cgroups will not withstand. Also, the kernal is an interface too big for what an AI agent needs and is therefore offering a gigantic attack surface completely unnecessarily.
  • TheRoque 2mo ago
    Would you say podman is better, or is it the same as docker ?
    • weinzierl 2mo ago
      In general running containers rootless is better from a security standpoint and podman makes this much easier. So, yes. This is not my main point though. Both are based on cgroups and cgroups are the wrong tool for the job.
      • TheRoque 2mo ago
        Wouldn't it need a super critical exploit, I mean zero-day vulnerability, to escape from that kind of sandbox ? And if you think further, then isn't that risk also applicable to pretty much any kind of sandboxing ?
        • weinzierl 2mo ago
          Container escapes are more common than you think. Common enough for AWS not to rely on containers for their serverless functions, common enough for Google to say: "Untrusted code shouldn't rely on the container security boundary [..]" [1] The same is not applicable for any kind of sandboxing for two reasons: 1. The boundary is in the kernal’s own code, enforced by the thing you are trying to be protected from. -> Use a VM 2. The kernal is a gigantic attack surface -> Use gVisor [1] https://docs.cloud.google.com/kubernetes-engine/docs/resources/security-patching https://docs.cloud.google.com/kubernetes-engine/docs/resourc...
• Esabelle 2mo ago
  [dead]
• weebull 2mo ago
  ...or...just hear me out now...we could limit it in the harness. Don't give it shell access, just predefined tools.
  • killerstorm 2mo ago
    What if it puts malicious code into test file and you allow `npm run test `?
  • mikesir87 2mo ago
    Disclaimer - on the Docker DevRel team One of the demos I run is how easy it is to circumvent the harness limits. For example, I can configure a harness not to access file `secrets.txt`. But, then I can immediately have it create a Python file that can read any file and have it read `secrets.txt`. At the end of the day, "please" isn't security. You want to know that the agent can only do and access the things it should access.
• dethos 2mo ago
  The other day I saw this: https://nono.sh/ https://nono.sh/ Haven't tested it yet, but it seems to address the same issue as Docker Sandboxes, but in a different way.
  • speedgoose 2mo ago
    I have tested it and the big advantage is that is has access to the local development tools. But it’s not as well sandboxed for sure.
    • LeBit 2mo ago
      Why do you say that? Eg, if used with Colima in macOS, it means I can run a devcontainer in an isolated VM and Nono inside the devcontainer can restrict a lot what can and cannot be done. You get credentials proxying and network outbound limits. How is Docker Sandbox better sandboxed?
      • speedgoose 2mo ago
        Yeah but that’s Colima and Nono then. Not only Nono.
        • isityettime 2mo ago
          True. But it's also an illustration of how relying on an OS' native sandboxing capabilities is nicely composable with other isolation techniques.
    • fg137 2mo ago
      As you as your Go build fails because you haven't put the local cache dir in the "allowed directories", you'll understand how painful this is, as well as most tools based on bubblewrap/sandbox-exec. There is a difference between a clean environment with standard setup vs a layer on top of everyone's existing tools/setup, especially in a enterprise environment. (I'm sure you can spend time to come up with a proper bubblewrap configuration that allows go build to succeed, but it's probably not worth the effort.)
• fergie 2mo ago
  I use it (sbx), but I don't 100% trust that it actually works, and I would prefer something open source where the limits of the sandboxing could be tested and explored. Maybe we should just ssh into separate development machines to ensure real and verifiable sandboxing? (as was totally standard before Docker became a thing)
  • LeBit 2mo ago
    You should research bubblewrap and nono.
• pjmlp 2mo ago
  I hardly see how this matters, when Apple and Microsoft already have their own in box solutions for the same problem. Better sandboxing for AI agents is exactly the main reason for containers improvements on macOS and Windows, with a few talks at WWDC, and BUILD. Not sure how much they would get from Linux users then.
• cv_h 2mo ago
  I wrote a CLI tool that uses QEMU's microvm machine type under the hood. It can take any docker image and build a microvm. I use it regularly to run Claude/Codex with permission checks disabled. https://github.com/cvhariharan/mvm https://github.com/cvhariharan/mvm
• d2p 2mo ago
  Does this support Linux yet? When I previously looked it did not (the reason being that they were already using VMs on Windows/macOS but not on Linux). Every time I see an announcement I think "great, they must've added Linux now then", but the linked pages always have Windows + macOS instructions but not Linux. All the open GH issues about supporting Linux that I subscribed to have gone unresponded to. OpenShell looks like a good alternative, but it still has "Do not use in production" plastered all over the website, which doesn't fill me with confidence yet
  • SwellJoe 2mo ago
    I think Linux has a better solution than Docker. I wrote a tool to use `bubblewrap` to containerize any agent (at least all the agents I've used a couple of times), and bind mount the system stuff read-only, so the agent has your "usual" environment, but they can only see the project. Their history persists (either through a bind mount or a "shadow" copy of the history that only the wrapped agent sees), the agent can still create and manage containers of its own using podman's rootless mode, etc. It's nearly instant to start because it's just a namespace (plus a few copied files for the container support and session history); no container needs to be built/fetched/updated/whatever. bubblewrap is extremely well-tested as it is used by flatpak and several other large projects, so I trust it quite a bit (more than I trust Docker). https://github.com/swelljoe/flar https://github.com/swelljoe/flar
    • fg137 2mo ago
      bubblewrap may work well for you and your specific workflows/projects but not in an enterprise setting where everyone already has a different setup on the host and needs something different inside the container. It's impossible to deploy a solution like that with bubblewrap -- configuration itself is going to be a nightmare. Which is why Docker Sandbox is aimed at teams/enterprises.
      • SwellJoe 2mo ago
        Yeah, Podman would be a better basis for that kind of use case. I'd built an early implementation of `flar` with Podman first, but it was more annoying than simply having my regular dev environment instantly available in the container. But if you need a bunch of different dev environments, instead of just your usual one, then sure, a bunch of different custom containers makes sense. But, Docker is rarely the right way to manage containers on Linux, IMHO.
• espadrine 2mo ago
  Models start going to extreme, damaging lengths to achieve ambiguous prompts[0]. Having good sandboxes is now a must IMO. But sbx is a bit annoying to use with OpenCode for instance (which has zero sandboxing by default, unlike codex CLI or Claude Code). You cannot easily change ~/.config/opencode/opencode.jsonc AFAIK. [0]: Black Hat OpenAI-Hugging Face incident: https://www.youtube.com/watch?v=87DyyMV0kCY&t=1021s https://www.youtube.com/watch?v=87DyyMV0kCY&t=1021s
  • eli 2mo ago
    That incident was with a model that had the guardrails disabled. Still obviously you should run all untrusted code in a sandbox, but extreme actions like that would be very unusual with the model that shipped.
  • dbmikus 2mo ago
    What's your problem with the OpenCode config? My startup (https://github.com/gofixpoint/amika https://github.com/gofixpoint/amika) copies agent configs into local or cloud sandboxes We run OpenCode currently, but need to improve the setup for users, so would like understand more of the issues you have sandboxing it, if you can share
• GZGavinZhao 2mo ago
  I'm confused: 1. If I run this on Mac, then inside the sandbox / microVM, am I still running MacOS or some Linux distribution? 2. If the only thing that's mounted from the host is the $PWD, how does it guarantee that it has all the system libraries that I have installed on my host system? e.g. my `/opt/homebrew` libraries or `sudo apt install libfoo-dev` headers
  • akdev1l 2mo ago
    Docker uses VMs in non-Linux OS to provide a Linux where containers can actually exist
• thomasahle 2mo ago
  Has anyone started proving their sandboxes in Lean (or Coq, etc.)?
• alasano 2mo ago
  I've been keeping a list of all the agent sandbox providers if you're looking for alternatives to this https://engine.build/lab/agent-sandboxes https://engine.build/lab/agent-sandboxes The open source section specifically.
• claud_ia 2mo ago
  [flagged]
• benguild 2mo ago
  Apple Container is an interesting work in progress: https://github.com/apple/container https://github.com/apple/container
  • gregwebs 2mo ago
    I am developing a project that makes running in Apple Container (Docker is an alternate runtime for Linux) more convenient: https://github.com/gregwebs/claude-contained/ https://github.com/gregwebs/claude-contained/ It blocks network access by default, mounts only what you specify, and you can add a customization layer. This is all done in the container itself (srt for network blocking). It doesn't implement a central point for secret sharing, MCP exposure, etc. So it might not have enough features for some but it works well for my needs. I just found through this thread yoloai which has an apple container backend, so its quite similar using that. My main issue would be that network access is allowed by default. https://github.com/kstenerud/yoloai https://github.com/kstenerud/yoloai Several other projects listed here use libkrun which is an alternate implementation that works with Mac's HVF. smolvm, microsandbox, podman (with likrun backend), gondolin.
• quantumwoke 2mo ago
  Just a small meta note: most of the comments in this thread appear to be posting their own codebase (typically AI-generated) that accomplishes the same goal. It's interesting that this problem is simultaneously in high demand and yet considered trivial enough to vibe code per-user solutions to it.
• deleted 2mo ago
  [deleted]
• killerstorm 2mo ago
  Are we sandboxing AI agent harness process, or the environment it executes commands in? Ideally, they should run in _different_ sandboxes. The environment might corrode the harness (e.g. rogue npm/pip packet would manipulate agent harness config).
• celrenheit 2mo ago
  I tried it and it worked great at first but I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source and not possible to customize to my need. One other thing, I want to be able to handle multiple repos in the same sandbox and have a standard workflow around worktrees (one worktree per repo, all the worktree mounted in the VM). These were some of the reasons that led me to build: Clawk - https://github.com/clawkwork/clawk https://github.com/clawkwork/clawk
  • notsirius 2mo ago
    "login multiple times for each sandbox" I've been using sbx for a bit now, and there have been some old versions that had this problem, but haven't had this problem in a while when using secrets https://docs.docker.com/ai/sandboxes/get-started/#authenticate-your-agent https://docs.docker.com/ai/sandboxes/get-started/#authentica...
• deleted 2mo ago
  [deleted]
• Cameri 2mo ago
  I was going to try it but signing commits with GPG using a Yubikey is not supported. The option left is to use SSH to sign commits which is a no-go for a different reason.
• Draiken 2mo ago
  Bubblewrap plus some whitelisting of domains/sockets is all you need. Docker is always a pain to use and this way I don't have to re-install everything a billion times for every different project.
  • llimllib 2mo ago
    This is what I currently do, but my software uses docker and docker mounts act as a bypass for the file system restrictions, plus docker processes started outside the sandbox allow network proxy escape. Currently, I don't allow the agent access to docker, start docker myself, and then do short-lived sandbox-free sessions when the agent needs to do things that interact directly with docker; but that's annoying.
• yagop 2mo ago
  I made this as an alternative https://github.com/yagop/sandbox https://github.com/yagop/sandbox works on any docker alike (OrbStack)
• franze 2mo ago
  Here is my solution which uses the Apple Virtualization Framework https://apps.apple.com/app/aifcc-ai-first-computer/id6782364574 https://apps.apple.com/app/aifcc-ai-first-computer/id6782364... als has lots of agents + and typical dev packages (node tooling, python tooling, ....) preinstalled
• llimllib 2mo ago
  Operating systems ought to be providing us the utilities we need to safely sandbox processes (agent or otherwise), but they appear to not be interested in the job
  • pjmlp 2mo ago
    Apple, Microsoft, IBM, Unisys, HP, Oracle/Sun have done that for a while now.
    • llimllib 2mo ago
      Poorly! Apple’s facilities for this are the ones I know best, and they are woefully insufficient
      • pjmlp 2mo ago
        Well, the features announced at WWDC 2026 naturally are yet to be made available in a mature form.
• _ache_ 2mo ago
  I planed to do exactly this, with podman instead of docker, volume support. Like: $ podman run -it --rm -v .:/workspace local-dev-ia /usr/bin/oc Configured with a .env file. Hope to do it hopefully before the end of the week.
  • codethief 2mo ago
    > exactly this This is nowhere near "exactly this". Docker Sandboxes uses micro VMs, you just use regular containers which have completely different security properties.
    • akdev1l 2mo ago
      podman run --annotation=run.oci.handler=krun -dp 8080:8080 -t --rm server-without-wasm
      • codethief 2mo ago
        Yes, you can run Podman with different OCI runtimes, in the same way as you can run Docker with different OCI runtimes, and some of these OCI runtimes are microVM-based. This is not what the person I was responding to is doing, though. As for differences between the krun OCI runtime and Docker Sandbox (which also uses libkrun), let's please continue the discussion here: https://news.ycombinator.com/item?id=49240662 https://news.ycombinator.com/item?id=49240662 .
• pullrun 2mo ago
  [dead]
• liquid_space 2mo ago
  [dead]
• codethief 2mo ago
  To everyone sharing their favorite container-based sandboxing solution: Docker Sandbox does not use containers for isolation. It spawns the workload in a libkrun-based micro VM, which has vastly different security properties.
  • akdev1l 2mo ago
    Do you mean like Podman has supported for years…? eg: https://josecastillolema.github.io/podman-wasm-libkrun/#libkrun https://josecastillolema.github.io/podman-wasm-libkrun/#libk...
    • codethief 2mo ago
      Do you mean like Docker has supported for years…? (Just configure krun as Docker's OCI runtime.) Obviously, there's a reason why Docker released Docker Sandbox as a separate product: - Barely anyone bothers to configure Docker/Podman with a different OCI runtime like krun. Heck, most people don't even know about OCI runtimes in the first place. Case in point: Most people here in this HN discussion are proposing using "standard" containers (with the default OCI runtime) for sandboxing. This is what I was trying to get at. - A sandbox for agent needs tighter network control. As for differences between the krun OCI runtime and Docker Sandbox (which also uses libkrun), let's please continue the discussion here: https://news.ycombinator.com/item?id=49240662 https://news.ycombinator.com/item?id=49240662 .
• deleted 2mo ago
  [deleted]
• genshro 2mo ago
  [flagged]
• PufPufPuf 2mo ago
  I built "Locki": something similar but open-source! A bit different approach -- single VM with Incus containers -- focusing on speed of spinning up new sandboxes and integraton with git worktrees. The core grievance that motivated me was the lack of docker/kubernetes support in existing sandboxing tools, with Locki there's no chance of footguns like "two agents rebuild :latest tag at the same time". Give it a try: https://github.com/JanPokorny/locki https://github.com/JanPokorny/locki
  • katspaugh 2mo ago
    Looks cool! I took a similar approach with https://runmachine.dev/ https://runmachine.dev/ but later switched to OrbStack for iOS development.
• cpburns2009 2mo ago
  So Docker is finally adding native support for a microVM backend? I wonder how it well it will compare to using the Kata Containers 4 runtime with the KVM/QEMU backend.
• hmokiguess 2mo ago
  https://xkcd.com/2044/ https://xkcd.com/2044/
• garganzol 2mo ago
  I do not see any value proposition in this - if I need a sandbox, I make one with Dockerfile, Bubblewrap or virtualization. What I am missing? An enforced required login is a net negative value - it means rug pulls in the future.
  • neop1x 2mo ago
    On Linux I am using https://github.com/wrr/drop https://github.com/wrr/drop which configures bubblewrap based on a simple yaml config specific for the project path and it is enough for me. I won't use anything requiring a login.
  • codethief 2mo ago
    While I agree that a proprietary solution is not great and personally I'd avoid it, too, I am getting https://news.ycombinator.com/item?id=9224 https://news.ycombinator.com/item?id=9224 vibes. :-)
• dhruv3006 2mo ago
  I think there is a yc company for this - https://github.com/trycua/cua https://github.com/trycua/cua
• s_ting765 2mo ago
  I use Flatpak/bubblewrap instead: https://news.ycombinator.com/item?id=48978112#48980221 https://news.ycombinator.com/item?id=48978112#48980221
• myshapeprotocol 2mo ago
  [flagged]
• lorreyfum 2mo ago
  [dead]
• khanhnguyen8386 2mo ago
  Finally, a way to run --dangerously-skip-permissions without having a mild heart attack every time the agent decides to rm -rf a mystery directory.
  • TZubiri 2mo ago
    'adduser agent' 'su agent' 'curl domain/install.sh | sh' 'runagent'
• threethirtytwo 2mo ago
  I don't want this that bad. I want the agent to have open access to my system because it actually does important administrative things for me. It is THAT convenient and powerful. Here's what I want: REALTIME OBSERVABILITY/POWERPOINT. I don't want to just see what command it ran. I need graphics... what part of the file system it is touching, what network entities it is contacting. If it's running SQL I want the parsed query handed to me in a syntax highlighted and well formatted interface. Imagine that star trek computer presenting automated infographics while someone is doing a presentation, you know what I'm talking about? It's like a automated powerpoint as the agent does it's thing. I need to understand my agent and what it typically does so I can dangerously wield it. I treat the agent like a gun in a live shooting scenario. That's how I want to use the LLM. Sandboxes have their purpose. Just like how shooting ranges have their purposes. But I need to fire my gun in the real world and real world is a warzone.
• krupkinmaxim 2mo ago
  [flagged]
• aki237 2mo ago
  I'm currently facing this issue. I've resorted to implementing my own execution environment albeit limited. It goes like this: - bash script parser + interpreter (with hooks for things like file open, execute etc.,) - wasm executor for execution. - wasm implementations of common tools like coreutils, grep, sed etc., from the uutils project. - wasm implementation of python by a VMware backed project. - entirely virtualized filesystem using Go's io/fs.FS. (tmp dirs can be implemented using any backend) Works like a charm for the limited usecase I have. There are definitely some drawbacks with threading and especially with preopens in wasm. But a cheap sandbox for simple file explorations and minimal computations.
• mikodin 2mo ago
  Does anyone have a solution for iOS development? I was all in on sandboxes and safehouse for my agents but the moment I got into iOS development it felt like my hand was forced to just run Claude / codex / pi directly on my machine because nothing else could do the dev loop. It’s been a painful reality for me, I’m going against core pieces of how I feel I should be interacting with agent harnesses and yet, I need to get the work done so
  • followercode 2mo ago
    Hey, I work at Docker and my team works on mcp integration with sbx. A solution I've been trying is this: 1) Enable the xcode mcp server: https://developer.apple.com/documentation/xcode/giving-external-agents-access-to-xcode https://developer.apple.com/documentation/xcode/giving-exter... 2) Add the xcode mcp server to sbx: `sbx mcp add xcode --command xcrun --args mcpbridge` 3) When you create the sandbox, use `--static-mcp xcode`. For example: `sbx create --static-mcp xcode claude .` Make sure you have at least v0.38.0 of sbx. This makes a bridge from inside the sandbox to the xcode tools on your host, so be aware that it can run whatever tools you give it on the host. But the agent itself is still sandboxed.
    • notsirius 2mo ago
      Also had this pain point as an sbx user. Given the risk this adds to the host, would be great if there were more docs on how to setup kits to make it safer (e.g. disable yolo mode).
      • followercode 2mo ago
        This may help you: https://docs.docker.com/ai/sandboxes/governance/access-controls/mcp/ https://docs.docker.com/ai/sandboxes/governance/access-contr...
• Roark66 2mo ago
  How about implementing proper permissions on the tool use or if you need more flexibility a dedicated model to analyse potential impact? (Like Claude Code's Autopilot but more configurable)? I find solutions like this to be a like trying to patch a leaking boat on a lake with duct tape. It will help, but it's not a proper solution. Also, often the tasks you want the AI to perform are in the outside world. Like "connect to my servers, and figure out X and Y". The proper way is permission isolation. I run a small k8 cluster in the homelab and I have 3 types of pod/agent combinations for my AI agents. Read only, one that can change my gitops but it needs to create PRs that admin approves, and admin. Likewise with code. I have a forgejo git instance where agents have ability to create feature branches and so on, but merging is gated. Those things require "GH enterprise features". In fact more and more things we do at home will require "enterprise features". Why? Because a person with AI is basically a small team, but some of team members behave like Chimps on crack... So security must be top notch.
  • victor_edka 2mo ago
    yea...I think k8s is de wae for running proper proper rbac sandboxes for agents.
    • kwakubiney 2mo ago
      Any idea of anyone exploring this space? Sounds interesting
      • victor_edka 2mo ago
        pfff...yes...but heavily biased as cofounder at edka... we're doing this https://edka.io/blog/codex-environments-on-kubernetes/ https://edka.io/blog/codex-environments-on-kubernetes/ and combined with this https://edka.io/docs/agents/conductor/ https://edka.io/docs/agents/conductor/ you'd get that.
  • iury-sza 2mo ago
    Implementing that is trivial in the harness side. You code vibe that in minutes.
• dhchun1203 2mo ago
  Neither of the recent ones was actually a container escape though. The OpenAI one in July found a misconfig in the sandbox network, and Kimi K3 last week just walked out to grab answers off GitHub during an eval. Both went through stuff the sandbox was set up to allow.
• st3fan 2mo ago
  Why is this not available for Linux?
• root-parent 2mo ago
  A Docker container is not a strong security boundary.
  • venatiodecorus 2mo ago
    these are firecracker microvms iirc, not containers
• pkulak 2mo ago
  I’m sure they fixed this, but since everyone runs docker containers as root… is every file this thing writes going to be root owned? Does it have root access to any resource to give it visibility to?
• mikedelfino 2mo ago
  Since everyone is sharing their setup, here’s my approach, just to give people an idea of how others are doing it, however impractical it might look: I run a full Linux VM (with a GUI) on my Linux host. I connect via virt-viewer to run Claude Desktop, as I’m not a fan of using the terminal for this. The VM sits on its own libvirt network in a dedicated firewall zone, and specific directories are shared via filesystem passthrough. To keep the agent from accessing anything related to Git, the actual gitdir is stored on a separate path outside the mount point. I review the git diff manually and commit it from the host.
  • everforward 2mo ago
    Do you find the permanence of a full VM useful? I’ve wondered about something like this but always defaulted to Docker for much the same reasons people use stuff like Ansible. I’m afraid the LLM will heavily customize its environment and I’ll be unable to replicate it when my laptop dies or I can’t upgrade the OS or whatever. Then again, I guess GUI is a pain in Docker. I tend to operate through Zed and an ACP harness though, so my GUIs are sort of “inside the container” anyways.
    • mikedelfino 2mo ago
      The VM is allocated 2 cores and 4GB of RAM. For my workload, it doesn't feel any slower than running it directly on the host. The few times I've checked memory usage, it wasn't anywhere near full as far as I remember.
    • Grimburger 2mo ago
      > I’m afraid the LLM will heavily customize its environment and I’ll be unable to replicate it Would suggest Hashicorp Packer or cloud-init for deterministic images, not hard to setup or use. LLM's have little problem with them either I find. If you need quicker environment rebuilds consider using something smaller like alpine as the base, though once you setup a golden image even heavy things like debian are fine.
    • geoka9 2mo ago
      My understanding is that the OP is not running any heavy tools/chains inside the sandbox? I use a similar setup, but using Incus and cli agents which I drive via ssh. I make sure I can (and do) rebuild the VM from scratch after every session or so. Currently considering using ACP for codex so that I can do more of the driving from my editor (emacs, over ssh) and something similar for claude code (it doesn't seem to be as good as codex at supporting re-attachable sessions). One concern is making sure my editor's ACP client doesn't enable/support fancy terminal stuff, because that would basically void all the benefits of using a VM sandbox.
• arscan 2mo ago
  Not a substantive comment on content but hopefully constructive feedback on presentation: Holy moly, on mobile I was trying to read the example console screenshots/snippets and then it would just unexpectedly change. Took me a little while to figure out it’s some kind of carousel for the examples, and not more screenshots/snippets loading and pushing down content (or me going crazy). Please don’t do this on mobile sites, just let me scroll through the examples!
  • mikesir87 2mo ago
    Thanks for the feedback! Will pass it on to the web team to get this more mobile-friendly.
• iamspoilt 2mo ago
  I recently wrote a blog post on using Tart for Macs for something similar that docker is doing here but with better persistence and control. My take is that the Tart approach is superior to this as it gives you a full dev machine with a single command line that allows agents to access files on host, install packages, maintain the vm and do whatever they want to do without compromising the host OS. https://www.mrafayaleem.com/blog/sandboxing-claude-cli-with-tart-on-apple-silicon https://www.mrafayaleem.com/blog/sandboxing-claude-cli-with-...
• lubo92 2mo ago
  [flagged]
• vira28 2mo ago
  I don’t see mention of pi. Does anyone whether it works? I am going to check out.
  • notsirius 2mo ago
    Yup https://github.com/docker/sbx-kits-contrib/tree/main/pi https://github.com/docker/sbx-kits-contrib/tree/main/pi https://docs.docker.com/ai/sandboxes/customize/kits/ https://docs.docker.com/ai/sandboxes/customize/kits/
• srini-docker 2mo ago
  I work at Docker. Lot of valid and useful feedback here that we're looking closely at. One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms. Explained a bit more here about the architecture and why those choices were made: https://www.docker.com/blog/why-microvms-the-architecture-behind-docker-sandboxes/ https://www.docker.com/blog/why-microvms-the-architecture-be...
  • kwakubiney 2mo ago
    Why’s it not on Linux? What are the difficulties with that platform?
    • cogman10 2mo ago
      Looks like they do support Ubuntu. Is this open source? Can I install this on a non Ubuntu system?
      • aborsy 2mo ago
        A limited form of it with different syntax comes with Docker Desktop. The sbx tool is not available for non-Ubuntu distributions.
      • rocfan 2mo ago
        CLI works on Fedora. Been using it daily for ~ a week. See repo `docker/sbx-releases`. The `.rpm` there has Rocky Linux in the name but works on Fedora.
    • srini-docker 2mo ago
      Linux is available today (Ubuntu): github.com/docker/sbx-releases. Our webpage showing only brew and winget is on us. For the people upthread who asked about on customization: templates (like snapshotting a running sandbox) and kits (YAML applied at creation like install steps, files, network and credential rules, or define a new agent outright) are the supported path now. It's early but take a look here: https://docs.docker.com/ai/sandboxes/customize/ https://docs.docker.com/ai/sandboxes/customize/ On MCP, since credential handling was mentioned here: the sandbox sees one gateway endpoint, and OAuth tokens stay in the host credential store rather than in the VM. https://docs.docker.com/ai/sandboxes/mcp-gateway/ https://docs.docker.com/ai/sandboxes/mcp-gateway/ All this is early. We're looking at more based on feedback from users like running sandboxes in the background for long-horizon work and a lot more (including what you all raised in the thread here). Keep them coming.
• tenner_agent 2mo ago
  [flagged]
• aniceperson 2mo ago
  systemd namespaces but less useful?
• deleted 2mo ago
  [deleted]
• schmitthub 2mo ago
  [dead]
• mifydev 2mo ago
  Is there an SDK? Can I create the containers programmatically?
• aegisora_ai 2mo ago
  [dead]
• OutOfHere 2mo ago
  Is it open source or not? What's the link to the code? There is no code at https://github.com/docker/sbx-releases https://github.com/docker/sbx-releases
• aegisora_ai 2mo ago
  [flagged]
• aliasxneo 2mo ago
  There must literally be hundreds of, "Looks cool, but I built <X>" in this thread. It leaves me with mixed emotions. If you're prone to analysis paralysis - this is an unfortunate time to be alive.
• wpdevant 2mo ago
  [flagged]
• rust-lang 2mo ago
  [flagged]
• guluarte 2mo ago
  the problem with this is... now i trust the agents more than myself lol
• GautamTalksDev 2mo ago
  [flagged]
• saadyousfi 2mo ago
  [flagged]
• KolmogorovComp 2mo ago
  How do you solve the issues of private key sharings that are stored in cwd .env? I haven’t found a satisfactory way to preserve them while letting the agent have access.
  • panarky 2mo ago
    [dead]
  • pamcake 2mo ago
    > How do you solve the issues of private key sharings that are stored in cwd .env? Stop putting sensitive stuff there.
• deleted 2mo ago
  [deleted]
• dorongrinstein 2mo ago
  we at Control Plane (https://controlplane.com https://controlplane.com) allow you to run sandboxes anywhere - any cloud (our AWS, GCP, Azure, OCI accounts) or your cloud or bare metal hardware. What sets Control Plane sandboxes apart is: - They can securely consume ANY service of ANY cloud without needing credentials - They can securely communicate to any VPC or private network resource - When you're ready to go to prod - you simply deploy to the Global Virtual Cloud (GVC) which can run in one region, multi-region, hybrid, any number of regions and clouds and data centers. our website is https://controlplane.com https://controlplane.com
• kylequest 2mo ago
  TLDR facts about Docker Sandboxes (based on its install): Uses ContainerD compiled natively for Mac OS and uses Nerdbox for the VMs: ├── bin │ └── sbx ├── libexec │ ├── containerd-shim-nerdbox-v1 <- Nerbox integration for ContainerD │ ├── mkfs.erofs │ ├── mkfs.ext4 │ ├── nerdbox-kernel-arm64 │ └── nerdbox-rootfs-arm64.erofs More info about Nerdbox is here https://github.com/containerd/nerdbox https://github.com/containerd/nerdbox
• BorisBinyaminov 2mo ago
  [flagged]
• CraftianAI 2mo ago
  I would have put 'microVM' in the title. While reading it, I wasn't sure if it is based on microvms or just rebranded/hardened containers. Also, what took them so long? Anyway, I decided to try it in a VM. Got: "You are not authenticated to Docker. Starting the sign-in flow..." (Just to try it.) Joke's on me.
• Magicrafter13 2mo ago
  So what "sandboxing" does this add that is not already present in Docker, and how can users be any more assured that software cannot break out (which has happened at times with Docker). Can a user blindly trust this sandbox, because that's how people will treat it based on the marketing. Sounds like it could be useful for far more than just AI though.
  • codethief 2mo ago
    > So what "sandboxing" does this add that is not already present in Docker Docker Sandbox spawns a micro VM, not a standard container isolated by host kernel mechanisms (Linux namespaces etc.)
    • Magicrafter13 1mo ago
      Does it come with the downsides of standard VMs? (Dedicated resources like memory and CPU cores, virtual disk images.)
      • codethief 1mo ago
        Yes, though since it's a "micro" VM, it shouldn't take up nearly as many resources as a regular VM. Some hypervisors also implement memory ballooning to not take up memory that's not being used, but I'm not sure whether Docker Sandbox's hypervisor implements that.
• jmox 2mo ago
  I am about to cry. I have been working on a project that actually made me feel I was bringing a new approach until I found this thread with an alarming number of similar tools.. I guess many of us used the same LLMs to help us building our "unique" solutions. My approach was to remove completely docker and start using podman as rootless daemonless alternative. It also has a good solution to user-namespace mapping when I mount my repositories inside the sandbox. I let the ai agent make changes but then I review them and push them from my host. As an alternative, you can create a ssh key pair on the host and load it into a dedicated ssh-agent, so you expose that agent socket to the agent container. For API Tokens and similar credentials, I solved it by putting a credential broker between the podman agent container and the LLM provider. To avoid doing any internal firewalling in the container I run a proxy as a podman container that enforces the egress policy (only https on allowed domains); so no network capabilities are required, the proxy itself handles the filtering. Because I had the idea of using the sandboxing framework to allow specific communication inside the network (for example for pentesting), it has also (apart from the proxy mode) a "routed"-mode implemented where a podman gateway is started; this does the network filtering without holding any kernel capabilities. nftables is configured using an ephemeral container with net_admin in the same network space (one-shot network initializer). The framework orchestrates the different required networks and Podman containers. I haven't tried the Docker solution yet, so I'll avoid comparing them.
• jasonli0226 2mo ago
  [flagged]
• deleted 2mo ago
  [deleted]
• deleted 2mo ago
  [deleted]
• beyondscale-sha 1mo ago
  [flagged]
• openflow 1mo ago
  [dead]
• sh1vang 1mo ago
  [flagged]