Docker Sandboxes Documentation

Docker Sandboxes is Docker's answer to running AI coding agents unattended, and docs.docker.com/ai/sandboxes is the reference you need to adopt it without fooling yourself about the security you are getting. The `sbx` CLI creates a lightweight microVM per sandbox — its own Linux kernel, its own Docker Engine, its own filesystem and network — and launches a supported agent inside it. Ten run out of the box: Claude Code, Codex, Copilot, Cursor, Gemini, Kiro, OpenCode, Droid, Docker Agent, and a bare `shell` sandbox for manual setup or anything unsupported. The docs are organised as Get started (install, first sandbox, agents), Agents, Workflows, Configuration, Integrations, MCP gateway, Customize, Architecture, Security, CLI reference, Troubleshooting and FAQ. The command surface is small and learnable in an afternoon: `sbx run --name my-sandbox claude`, `sbx ls`, `sbx policy ls`, `sbx policy allow`, `sbx stop`, `sbx rm`. The most valuable pages sit under Security, where isolation is documented as five explicit layers: hypervisor (a separate kernel per sandbox, host processes invisible from inside), network (outbound TCP forced through a host-side policy proxy, UDP and ICMP blocked, policy-enforcing DNS), Docker Engine (a separate engine inside the VM rather than a mounted host socket), workspace (direct mount, which gives no isolation at all, versus clone mode against a read-only host repo), and a credential proxy that injects auth headers on the host so API keys never exist inside the VM. Unusually for vendor documentation, the same pages state the limits: clone mode protects the repo from modification but not inspection, `.env` files stay readable, hard links pointing outside the workspace can still be followed, and local MCP servers run on the host outside the sandbox. Install is documented for macOS via Homebrew, Windows via winget and Ubuntu via apt; the CLI is free including for commercial work, with organisation-wide policy enforcement sold separately as Docker AI Governance.

Topic

Agentic

Level

Intermediate

Format

Documentation

Cost

Freemium

Duration

~2-3 hours to work through Get started, Security and the CLI reference; first sandbox running in about 15 minutes

Provider

Docker

Hands-on

Yes — code/exercises

Certificate

None

• ✓How to launch Claude Code, Codex or OpenCode inside a disposable microVM using the sbx CLI
• ✓Why a microVM with its own kernel isolates an agent more strongly than a plain container
• ✓How the network policy proxy forces outbound TCP through host-enforced allow rules and blocks UDP and ICMP
• ✓The difference between direct-mount and clone workspace modes, and why direct mount gives no isolation
• ✓How a host-side credential proxy keeps API keys out of the agent's filesystem and environment entirely
• ✓Which attacks the sandbox does not stop: .env inspection, hard links out of the workspace, host-side MCP servers
• ✓The everyday sandbox lifecycle: sbx run, ls, policy ls, policy allow, stop and rm
• ✓How to install sbx on macOS, Windows and Ubuntu, and which capabilities require the paid governance tier

• •The Security section documents the threat model AND the gaps, which is rare in vendor documentation and is the reason to read it.
• •Five separately documented isolation layers — hypervisor, network, Docker Engine, workspace, credential proxy — each with its own page.
• •The credential proxy is the standout idea: auth headers are injected on the host, so a compromised agent never holds your keys.
• •Free for commercial use; only organisation-wide policy enforcement (Docker AI Governance) sits behind a paid tier.
• •Ten agents supported out of the box plus a bare shell sandbox, so you are not locked to one vendor's coding agent.
• •Read the Hacker News thread alongside it: the loudest complaint is the required Docker login, which bites in headless and CI use, and commenters compare it against Incus/LXD, Firecracker, gVisor and bubblewrap.

This page was written from 6 sources, 2 on domains other than docs.docker.com.

1. 1.docs.docker.com — sandboxesvendor
2. 2.docs.docker.com — get startedvendor
3. 3.docs.docker.com — isolationvendor
4. 4.docs.docker.com — agentsvendor
5. 5.docker.com — docker sandboxes
6. 6.news.ycombinator.com — item