Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

Post reply on HN
Print view View original

241–250 of 407 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#241

Post by macNchz »

ethagnawl wrote: post #230
hokkos wrote: post #39

Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes. (it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)

Whoah. I took for granted it'd work on Linux.

It does, for whatever reason the marketing page doesn’t advertise it but the docs have Linux instructions: https://docs.docker.com/ai/sandboxes/

I’ve been using this pretty extensively for a few months on Mac and Linux and have been super happy with it.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#243

Post by [deleted] »

RagnarD wrote: post #151
TheqO wrote: post #115

Earlier quoted context omitted.

There are many devs that have little to no experience of Linux, like the hundreds of thousands of .Net and Java CRUD devs in enterprise companies using Windows. There is a need for a Docker desktop like GUI for this market.

Huh? https://docs.docker.com/desktop/setup/install/windows-instal... Also, WSL (Windows Subsystem for Linux) has been baked into Windows for a long time and makes it very easy to play with Linux, as does using the Hyper-V VM system. Any developer unfamiliar with Linux because they use Windows, has little excuse.

[deleted]

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#244

Post by TacticalCoder »

sparsesignal wrote: post #97
rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

What I run is one hardened QEMU/KVM VM per project holding the whole dev environment (editors, agents, containers), with nftables on the host allowing internet egress but dropping anything aimed at the host, the LAN, or any other private address, plus an allowlist for deliberate exceptions. Basically, it's a plain QEMU/KVM VM on a stock Debian cloud image: device model stripped down to a virtio disk, a virtio NIC and…

Yeah I discovered your blog a few days ago: I've got a setup not unlike yours.

> So rather than pick one, this post advocates layering both, in the spirit of defense in depth: a sandbox VM wraps your containers along with the whole toolchain, and that sandbox reaches the internet but has no route to anything private.

Yup it's the only proper way.

And that is true not just for AI harnesses/agents (that shall try to escape), but also for stuff like Plex/Jellyfin/Immich/private pastebin etc.

If you care about security, there really simply is zero reason to run containers on the bare metal.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#245

Post by pjmlp »

RagnarD wrote: post #151
TheqO wrote: post #115

Earlier quoted context omitted.

There are many devs that have little to no experience of Linux, like the hundreds of thousands of .Net and Java CRUD devs in enterprise companies using Windows. There is a need for a Docker desktop like GUI for this market.

Huh? https://docs.docker.com/desktop/setup/install/windows-instal... Also, WSL (Windows Subsystem for Linux) has been baked into Windows for a long time and makes it very easy to play with Linux, as does using the Hyper-V VM system. Any developer unfamiliar with Linux because they use Windows, has little excuse.

Agreed, even game devs that ignore Linux as target for their AAA games, actually tend to use Linux for game servers, the age of IIS with .NET/ISAPI is long gone, except for legacy code stuck in .NET Framework.

Modern .NET did not went cross platform by accident, and Java development has always been "develop on Windows deploy on UNIX", in corporations where Mac tends to have little presence.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#246

Post by Thanemate »

sylvinus wrote: post #213
rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

Are we all posting our agent VM containers ? :) https://github.com/sylvinus/agent-vm

We're basically at the point where people can build their own "X", with "X" being internal tooling.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#247

Post by pjmlp »

llimllib wrote: post #183

Operating systems ought to be providing us the utilities we need to safely sandbox processes (agent or otherwise), but they appear to not be interested in the job

Apple, Microsoft, IBM, Unisys, HP, Oracle/Sun have done that for a while now.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#248

Post by TacticalCoder »

dist-epoch wrote: post #126
Grimburger wrote: post #37

> Each agent runs inside a dedicated microVM with your dev environment What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts? Is it marketing fluff? Incus/LXD has had VM's for a long time now. incus launch images:ubuntu/26.04 my-ubuntu-vm --vm incus exec my-ubuntu-vm -- bash

An Ubuntu Server VM, like the ones started by Incus, use at least 512 MB of RAM per instance. If you spawn 10 sandbox VMs, you already pay 5 GB RAM just to sit there idle. You also pay a CPU cost, you have 10 kernels managing stuff, but arguably it doesn't matter that much given CPU core counts. I use something in between - a single Ubuntu VM, into which I spawn multiple Incus LXC containers for the agents. The conta…

Yeah this basically. I differentiate between "containers I wrote" (where I packaged the app/wrote the OCI "Dockerfile" / container file) and "containers from other people": all those I wrote (for our own use) go into one VM, while all the other containers go into another VM. Then I've got a third VM for containers for the AI agents.

This way I don't pay tens of VMs "tax" but basically only three (plus one or two VMs I use for testing enhancements to my VMs provisioning / optimization / securing setup, when I work on that).

I don't use LXC (I could) but regular containers, inside VMs.

I'll look into the stripped down "micro" VMs but then I don't spend my days launching VMs/shutting them down so it's not a big deal.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#249

Post by cpuguy83 »

duxuev wrote: post #138
d2p wrote: post #117

Does this support Linux yet? When I previously looked it did not (the reason being that they were already using VMs on Windows/macOS but not on Linux). Every time I see an announcement I think "great, they must've added Linux now then", but the linked pages always have Windows + macOS instructions but not Linux. All the open GH issues about supporting Linux that I subscribed to have gone unresponded to. OpenShell loo…

I also hit the same issue recently. No Linux and no Windows on arm. AI sandboxing has a lot of options but none feel complete just yet. It's hard to commit to something, especially if reviewing tools to aide in company policies. Regardless, I'm hoping something that isn't behind a login screen is going to win out.

I'm fairly certain that docker sandbox is based on https://github.com/containerd/nerdbox which you can run on Linux.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#250

Post by Eldt »

skinfaxi wrote: post #217
llimllib wrote: post #190

Earlier quoted context omitted.

right, but say you give the agent access to github and it can push as you, or make a gist; now it can easily exfiltrate your secret. And that's just an easy case - really if it has any network access at all it can come up with a clever way to route a request through the network such that the key comes back somewhere in the request. If you scan for it inbound too, the machine can obfuscate it. Our agents are trained t…

The agent has no access to the secret. It has a placeholder that is replaced at a higher level. When it makes the network request the secret is substituted but that is outside of the caller's worldview.

So what stops it from sending a network request to a git repo that pushes what that placeholder resolves to?
Post reply on HN