Docker Sandboxes – Disposable, isolated sandboxes for AI agents | AI Paper Digest

TL;DR Highlight

Running agents in microVMs lets you skip permission prompts while keeping the host safe

Who Should Read

A developer who wants to run Claude Code or Codex unattended without permission prompts but worries about their laptop

Core Mechanics

It's a microVM, not a container
- Each sandbox gets its own kernel and private Docker Engine.
- Docker says there is no path back to the host.
Isolation replaces permission prompts
- --dangerously-skip-permissions is the default.
- The boundary is infrastructure, not the agent's judgment.
docker compose works inside the sandbox
- Each sandbox has its own private Docker Engine.
- No socket mounting or host privileges are needed.
One YAML Kit pins the environment
- It sets tools, credentials, network rules, and config together.
- Run it with sbx run claude --kit <url>.
Secrets and MCP are scoped per sandbox
- Real secrets stay on the host outside the VM.

Community Reactions

The login requirement was the top complaint
- Several commenters said local sandboxes shouldn't need a login.
- Some preferred open source options without signup.
Outbound firewall and secret injection are the draw
- One user said these two features made it their daily driver.
- They mount each git worktree in a per-repo sandbox.
Linux support and custom mounts are missing
- One commenter said Linux support issues went unanswered.
- Another couldn't mount two directories for context.
Many alternatives were shared
- Locki, Gondolin, Tart, Apple container, and devcontainers came up.
- One commenter argued permission isolation is the real fix.

How to Apply

Install sbx and try it on a small repo
- Run brew install docker/tap/sbx, then sbx run claude.
- Compare the agent's changes against your host state.
Enable MCP servers per project
- Run sbx mcp enable github-official --sandbox <name>.
- Don't enable it on other sandboxes.
Write a team Kit YAML
- Put tools, network rules, and credentials in one YAML file.
- Have everyone start from it with the --kit option.
Check login and Linux support first
- Confirm it fits your team's environment.
- Compare the open source alternatives from the comments if needed.

Try It

copy & run

# Paste into your shell (macOS, install command from the source)

brew trust docker/tap && brew install docker/tap/sbx

# Run Claude Code in a sandbox
sbx run claude

# Enable GitHub MCP for one sandbox only
sbx mcp ls
sbx mcp enable github-official --sandbox {{sandbox-name}}

# Delete when done
sbx rm {{sandbox-name}}

Terminology

microVMA very lightweight virtual machine. Unlike a container it has its own kernel, like living in a separate building.

Docker-in-DockerRunning Docker inside a container. It usually needs elevated privileges, which is a security burden.

YOLO modeA mode where the agent runs without permission checks. Here --dangerously-skip-permissions is the default.

KitA YAML config applied at sandbox startup. Like a recipe that adds tools and network rules at once.

MCPA standard protocol for connecting agents to external tools.

Docker Sandboxes – Disposable, isolated sandboxes for AI agents