Docker built a cage for YOLO mode
Docker Sandboxes shipped: disposable microVM environments whose entire purpose is to let you run a coding agent with permissions off and not lose your laptop. It hit 609 points on Hacker News in fifteen hours, which tells you how many people have been running dangerously-skip-permissions and quietly hoping.
A microVM is a real boundary, not a container namespace hand-wave. Host filesystem, host network, host credentials all stay outside. Inside, the agent gets a genuine dev environment β install packages, edit configs, run services, even spin up its own containers, since Docker-in-Docker works. You define what network and filesystem it can touch. When it's done, you throw the thing away.
Install is a one-liner. brew install docker/tap/sbx on Mac, winget on Windows, apt on Ubuntu, and you don't need Docker Desktop. Free for local use. Claude Code, Codex, Copilot CLI, Gemini CLI, OpenCode and Kiro are supported out of the box. The money is in Docker AI Governance, the paid tier for org-wide network policy, filesystem rules and MCP governance β which is Docker betting that the enterprise problem is not one developer's sandbox but a thousand of them.
Worth pairing this with the gym story from the same day. The sandbox contains blast radius on your machine. It does nothing about an agent with a valid API token doing something clever on the far side of the network. Local isolation is solved, roughly. Authorization is not.
https://www.docker.com/products/docker-sandboxes/
← Back to all articles
A microVM is a real boundary, not a container namespace hand-wave. Host filesystem, host network, host credentials all stay outside. Inside, the agent gets a genuine dev environment β install packages, edit configs, run services, even spin up its own containers, since Docker-in-Docker works. You define what network and filesystem it can touch. When it's done, you throw the thing away.
Install is a one-liner. brew install docker/tap/sbx on Mac, winget on Windows, apt on Ubuntu, and you don't need Docker Desktop. Free for local use. Claude Code, Codex, Copilot CLI, Gemini CLI, OpenCode and Kiro are supported out of the box. The money is in Docker AI Governance, the paid tier for org-wide network policy, filesystem rules and MCP governance β which is Docker betting that the enterprise problem is not one developer's sandbox but a thousand of them.
Worth pairing this with the gym story from the same day. The sandbox contains blast radius on your machine. It does nothing about an agent with a valid API token doing something clever on the far side of the network. Local isolation is solved, roughly. Authorization is not.
https://www.docker.com/products/docker-sandboxes/
Comments