Docker Sandboxes – Disposable, isolated sandboxes for AI agents

Post by speedgoose » Mon, Aug 10, 2026, 3:17 PM UTC

LeBit wrote: post #148

speedgoose wrote: post #123

Earlier quoted context omitted.

I have tested it and the big advantage is that is has access to the local development tools. But it’s not as well sandboxed for sure.

Why do you say that? Eg, if used with Colima in macOS, it means I can run a devcontainer in an isolated VM and Nono inside the devcontainer can restrict a lot what can and cannot be done. You get credentials proxying and network outbound limits. How is Docker Sandbox better sandboxed?

Post by mikesir87 » Mon, Aug 10, 2026, 3:20 PM UTC

eglintondust wrote: post #204

kellpossible2 wrote: post #165

Earlier quoted context omitted.

what's to stop an agent creating an outbound call with the var to a malicious endpoint? (unless you whitelist what it has access to)

You just don't inject the real secret unless hostname/whatever rule matches the request, right? I don't know if that's how this works but it's my assumption.

Post by Grimburger » Mon, Aug 10, 2026, 3:24 PM UTC

everforward wrote: post #277

mikedelfino wrote: post #273

Since everyone is sharing their setup, here’s my approach, just to give people an idea of how others are doing it, however impractical it might look: I run a full Linux VM (with a GUI) on my Linux host. I connect via virt-viewer to run Claude Desktop, as I’m not a fan of using the terminal for this. The VM sits on its own libvirt network in a dedicated firewall zone, and specific directories are shared via filesystem…

Do you find the permanence of a full VM useful? I’ve wondered about something like this but always defaulted to Docker for much the same reasons people use stuff like Ansible. I’m afraid the LLM will heavily customize its environment and I’ll be unable to replicate it when my laptop dies or I can’t upgrade the OS or whatever. Then again, I guess GUI is a pain in Docker. I tend to operate through Zed and an ACP harnes…

Post by mikesir87 » Mon, Aug 10, 2026, 3:32 PM UTC

weebull wrote: post #93

...or...just hear me out now...we could limit it in the harness. Don't give it shell access, just predefined tools.

Post by messh » Mon, Aug 10, 2026, 3:41 PM UTC

llimllib wrote: post #260

skinfaxi wrote: post #253

Earlier quoted context omitted.

How would that work? You don't control github.com servers so your repo would never see the secret. edit: You may want to look into tokenizing proxies as the general application of this concept.

Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt