I did try to use those for some stuff: * Login requirement is something else * It's closed source last I checked * Pretty slow/unstable
There are many better namespace/container based options, VMs may be moderately more secure but when you more or less trust your agent and code you can do with lesser containment. And with the recent CVEs in kvm honestly there isn't a huge deal of difference vs namespaces.
(I'm building https://xbin.dev/ for some time now for managing my personal code/apps, a project which started specifically after Docker Sandboxes broke on me some time ago)
> Each agent runs inside a dedicated microVM with your dev environment
What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts?
Is it marketing fluff?
Incus/LXD has had VM's for a long time now.
incus launch images:ubuntu/26.04 my-ubuntu-vm --vm
incus exec my-ubuntu-vm -- bashIt’s real VMs, firecracker style.
That's a full VM. Microvms are much smaller and they start up very very fast. In miliseconds.
The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders.
I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in.
Closest open source I have seen is https://earendil-works.github.io/gondolin but the DX is not as polished. https://exe.dev/ would be perfect but it does not come with outbound firewall.
Does anyone have a better alternative?
I wrote this for myself and have been using it regularly.
It is FOSS
Eclipse Enclave does exactly that: There is an outbound firewall and secret injections, so that the agent never sees a real key. And it's fully open source: https://github.com/eclipse-enclave/enclave
What is the main benefit over doing something like:
docker run --runtime krun --rm -it -v $(pwd):/workspace/$(basename $(pwd)) -w /workspace/$(basename $(pwd)) --network restricted-net ghcr.io/openai/codex-universal:latest sh
I just made my own devcontainer that I copy on any project and load whatever harness I want in that repo. Harnesss' config and auth are simply mounted from the host, so no setup required at all.
https://github.com/iodize6399/ai-devcontainer/tree/main/.dev...
[dead]
Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes.
(it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)
What about bubblewrap? It also provides a sandbox
There's always https://github.com/mensfeld/code-on-incus
[dead]
I used this for a while then decided to build my own suites that pack individual harness and respective host state (config, plugins, skills, etc.) into an image. Works better and much flexible in my opinion.
I started building my own isolated and security-hardened docker image for OpenCode about half a year ago. Been using it daily.
I got excited for this not because this didn't exist before, but because Docker putting their weight on this would imply a broader adoption and better integration in the industry. I am sad that they are asking for a login here though, which doesn't make any sense to me.
That's docker, man. Tomorrow they're gonna add limits on sandbox runs without a premium account too
Can someone more versed in Docker explain to me how this is different than building my own docker container from a Dockerfile for using Pi agent harness? That's what I do currently. I use Docker Desktop in windows as the backend for that.
Docker containers use Linux kernel features to create an isolated environment, running on the same machine as docker is. This creates a virtual machine, with its own kernel, and runs the container in there. This gives stronger isolation and security guarantees.
I have the same question as GP. Your answer helps a little but not really. I might be naive, but I was under the impression that malicious code escaping a docker image and running amok on my host system was not something I should be too worried about. Especially if I run docker in rootless mode. Is that wrong?
For clarity I’m actually using podman, not Docker.
Oh no, you should definitely be worried about that. Podman might make it harder to escalate to host root, or manipulate other containers, but it is still vulnerable.
Now I'm curious to know how hardened the Docket Sandbox orchestration interface is. I guess we can assume they have run Mythos against it for a few weeks maybe? It's unclear.
That depends on the runtime though. For example, libkrun lets you do this:
docker run --runtime krun hello-world
It's a VM.
The sandboxing problem is perhaps the greatest justification for doing agent integration via existing human interfaces rather than low level shell access. Granting access to shell is a super obvious path (it's easy) so I can understand us wanting to fight for it. But we should consider the other paths as well before we make our final stand.
Automating browsers with LLM agents properly requires a lot more work than Process.Start into powershell, but the advantages can be immense once you have achieved integration this way. Incrementally maintaining this integration is generally easy because human users cannot tolerate rapid changes either.
It's a hell of a lot easier to convince management to adopt a robot that looks and acts like a human employee than one that looks like a combine harvester. The combine is far more efficient, but it is also totally indiscriminate. Nothing constrains its appetite except for the invisible fence imposed by GPS. The amount of infrastructure required to keep farm equipment from running astray is incredible. In the context of agriculture, the added complexity is definitely worth it. We don't want to have to recreate the same thing with our technology if it can be avoided. Sandboxes and security isolation boundaries are not things to aspire to. These are costs to be paid for admission to something more valuable.
Most interesting part to me is credentials injection at the sandbox boundary level: https://docs.docker.com/ai/sandboxes/security/credentials
Doesn't everyone do this now? It's hardly a new idea. Yet every time someone proposes the idea, people fawn over it and proclaim it the best thing ever.
Yes, you can inject tokens via a proxy. What else is new?
If any AI company was doing serious engineering isolated containers would have been a prerequisite to using their tools.
Anyone serious about security will want to bring their own sandbox anyway, not trust these, often proprietary, agents. I've never run an agent outside a sandbox. My first bubblewrap script for `claude` is now over a year old. The tools are available and if you learn to use them you can run any program in a sandbox.
But, in any case, why put in effort doing something people don't expect or ask for? We can assume everyone running agents is either a) using their own sandbox, or b) doesn't care. I think we can guess which category most people fall into. You could maybe argue about responsibility, but I don't think you can argue about "serious engineering".
Reminds me of sandboxy - https://github.com/apple/containerization/tree/main/examples...
Also if your thing doesn't work with `pi` out of the box, then low effort
Requires login. Garbage.
I build a OSS lightweight, portable VM for those that don't want lock ins: https://github.com/smol-machines/smolvm
I have a solution based on Nix that can be used to generate reproducible container images: https://github.com/nothingnesses/agent-images . It lets you customise which agents, harnesses, or any other packages you want included in the VM and it uses `agent-box` for sandboxing.
This looks like gvisor but is a vm like firecracker right? Any reason you did not want to use firecracker?
(I am testing this now as a backend for my pet project which currently supports firecracker and gvisor. No network.)
What? Does using sbx require login? Bummer.
Yes and they have a specific subscription for managing sandbox policies across the enterprise: Docker AI Governance
You can create those manually but if you want to enforce those then you need the subscription
I know some people want to run their agents when their computer is off, but I imagine a solution like this will be much more common than paying for a remote sandbox (i.e on fly.io or exe.dev), especially because it'll be free.
Though, they need to remove the login requirement.
I tried Docker Sandboxes but last time I checked you could not configure custom volume mounts, making more complex setups impossible. For work I need two directories for context for the agent to have access to…
Try https://github.com/ashishb/amazing-sandbox
You give implicit access to current directory and can mount as many custom volume mounts as you would like. And it is FOSS.
put them both inside another directory and share that? what am i missing?
I’d rather use another open source solution that doesn’t require a signup, and less likely to get rugpulled.
There is no reason to require a login for creating local mini sandboxes.
If you’re on Apple, native solutions like “container-machine init” come built in and are pretty good, if you’ll only be on Apple hardware.
Open source alternative with podman support and local telemetry collection https://github.com/VibePod/vibepod-cli
Looks really nice. Would it be easy to make a qwen-cli wrapper?
So this is a VM by Docker?
For those who do not trust
docker run --rm -it -v "$(pwd)":/work -w /work myaiimage /bin/bash
Better yet, use Apple's container CLI if you're on a Mac, instead of the docker bloatware.
container run --rm -it -v "$(pwd)":/work -w /work myaiimage /bin/bash
Hasn't Docker always been just a thin layer of duct tape over existing solutions?
Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a hard sell.
I did the same thing. It was my first "vibecoded" project. I've been using it every day and it's great. I'm writing a custom Rust network stack for it right now. Gonna replace the current nftables firewall with it.
As for Docker Sandboxes, I'll just ask Sol literally right now to see what it does better than my virtdev, and then I'll improve virtdev instead of using Docker.
Were you following any patterns/standards/advice on what you needed to protect against? Anything you can point the rest of us to?
> Were you following any patterns/standards/advice on what you needed to protect against?
Just the general knowledge that sharing a kernel with untrusted software is too dangerous, that hardware virtualization is an infinitely smaller attack surface and that the entire industry will be in deep shit if people or AI breaks hypervisors.
Initial threat model was supply chain attacks but eventually grew to include AI harnesses as well. Not very worried about them hacking me, more about accident prevention.
So that means each VM must be running a completely independent kernel that's fully isolated from the host's file system. They must also have fail closed network filtering built in.
> Anything you can point the rest of us to?
I have published my virtdev's design document.
https://github.com/matheusmoreira/virtdev/blob/master/DESIGN...
Yes, it is AI generated.
In summary, it's a QEMU VM orchestrator with a base OS image and project specific delta images. VM lifecycle is managed by systemd. System level isolation is already pretty good and it already solves the "AI wiped out my $HOME" problem. I'm currently working on a custom network stack to replace the nftables based firewall.
You want to prevent the agent/others from reaching your home directory and other things. As long as you don't mount/sync directories/files from/to the container, so no mounting like "-v $(pwd):/app", but instead copy in, then when done, copy out.
And of course, instead of doing the "copy in > copy out" process manually, get your local agent to write a bash script that does that for you, given what directory you're in, and you're basically G2G.
What is the advantage of copying rather than a bind-mount?
What specifically are you looking for? If you start from the premise that it runs as you right now, then that's something you can easily improve upon.
Start by mounting just your repo and passing in the keys for the agent. Take it from there, it's like software engineering, you iterate.
When you run into issues you expand the tools in the container available to it.
[dead]
The one thing I wonder about is how you enforce the usage of Docker Sandboxes vs running the agent on the host directly, apart from scanning machines for binaries
I am not sure I understand, how is this different from a devcontainer or other similar techniques?
On another topic, can't help but notice that "leading coding agents" somehow does not include Pi.
it's running a full VM so the agent can eg: run docker commands safely etc
So it's basically a container with a fancy name, innit?
been using this for a while - works great! Has also had a lot of updates over the past year so worth checking out again if you tried it a while ago
Do the agents come preinstalled in the images? Or do they somehow use whatever I’ve installed locally? The former makes sense to me but then I’m wondering whether the sandbox images stay up to date with new releases of each image.
Here's another sandbox that I found interesting: https://github.com/ashishb/amazing-sandbox
Very interesting. Thanks for sharing.
Ah let's see, do they still want you to LOGIN, in order to use a local dev tool? Yes, yes they do. No thanks Docker. You can keep your buzzword reasoning as to why this is needed.
On Linux, you can skip Docker and use bubblewrap. Some inspiration: https://blog.gpkb.org/posts/ai-agent-sandbox/
TO me, that's the important distinction: sandboxing limits what the agent can do but it doesn't necessarily enforce that the agent must run inside the sandbox. You need a separate control layer to enforce that boundary.
You design the sandbox so the agent starts in that layer. The next thing you can do is to limit the network access, this is what I'm working on right now.
Or do you mean something else?
The linked page implies there is no linux support, I wonder why. It's there in the docs if you hunt for it.
The docs are here: https://docs.docker.com/ai/sandboxes/
The other url is their marketing page.
Yes, Linux is supported.
Docker management will fail their tech at every opportunity.
[flagged]
[flagged]
[dead]
[dead]
[dead]
There is a name collision on MacOS where MacOS also provides containers [1]
Why less workflow friction?
Customize the exact environment of your container from the ground up (harnesses, tools, base image, packages, mounts, etc) and enter with a single command.