““this isn't containers. Each session is a microVM” — srini-docker on Hacker News”
You know that feeling when you want an AI agent to fix code, but the agent needs shell access, package installs, Docker, network calls, and credentials to do real work. Running that directly on your laptop means a bad command can touch your working tree, local config, or Docker socket. A plain container helps, but Docker says containers or Docker-in-Docker still leave the wrong trust boundary for autonomous agents that need Docker. Sandboxes moves the agent into a microVM so it gets a real Linux environment without host-level Docker control.
Think of it like handing the AI a rented workshop with its own toolbox, doors, and trash bin. You run `sbx`, Docker creates a microVM, mounts your project workspace, starts a private Docker daemon inside the microVM, and routes web access through a host-side proxy. Your credentials stay on the host and get injected through controlled paths instead of sitting raw inside the VM. When you finish, you remove the sandbox and its VM contents. The key design choice is that the agent can run Docker inside the sandbox without reaching your host Docker socket.
If you run AI coding agents against real repos and those agents need shell, Docker, package installs, or MCP tools, this is directly relevant. It fits your workflow if you care more about local isolation than pure startup speed. It is not a good fit if you need no-account setup, zero VM overhead, or fully stable customization kits today.
Yes, explore it for local AI-agent safety spikes, especially if you already trust Docker tooling. Treat it as experimental for policy-heavy workflows: the notes show 246 or 247 open issues, experimental kits, early-access customization, and issue #408 around settings overrides. Do not treat the marketing line about no tradeoff literally; Docker’s own docs name higher VM and daemon overhead.
Deep-dive insight, Easy and Pro modes, plus action playbooks — the full breakdown is one tap away.