Docker Sandboxes: disposable microVMs for AI coding agents

Docker has introduced Sandboxes, a product that runs AI coding agents inside disposable, isolated microVMs. It targets agents such as Claude Code, Copilot CLI, Codex, OpenCode and Kiro that need safe, unattended execution. Installation is offered through Homebrew on macOS, winget on Windows and Docker's apt repository on Ubuntu.

What happens inside a sandbox

Each agent runs in a dedicated microVM that holds the developer environment, with only the project workspace mounted in. Inside it an agent can install packages, modify configurations and start its own Docker containers, while the host machine is left untouched. Because the boundary is a microVM, permissive modes become the default rather than a risk: the documentation states that the --dangerously-skip-permissions flag, commonly known as YOLO mode, is used without manual review, permission prompts or supervision.

Isolation, teardown and controls

Docker describes the microVM as a hard security boundary from the host. A sandbox starts faster than a full virtual machine while providing more isolation than a plain container, which is what allows nested containers to run safely inside it. Network and filesystem rules are configurable per sandbox, and sandboxes are disposable by default, so a finished session is removed with a single command. Teams that need centralized network policies, filesystem rules and MCP governance across machines are pointed to Docker's separate AI Governance product. Docker Desktop is not required.

Which agents are supported

Out of the box, Docker lists support for Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode and Kiro, and says custom agents can be added. The company frames the product around a simple argument: agents do their best work when they have freedom, and sandboxes are meant to remove the tradeoff between speed and safety.

Partner reaction

Gavriel Cohen, creator of NanoClaw, said the principle behind his project is that you do not trust agents with security but build walls around them, adding that Docker Sandboxes is what that approach looks like at the infrastructure level. Ben Navetta, engineering lead at Warp, said the sandboxes give agents the autonomy to take on long-running tasks without compromising safety, and that Warp is integrating them so developers get a consistent environment whether agents run locally or in the cloud.