Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

Post reply on HN
Print view View original

341–350 of 427 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#341

Post by xrisk »

bmurphy1976 wrote: post #338
dallen33 wrote: post #333

Earlier quoted context omitted.

How so?

The parent didn't go into any detail. I can. Homebrew has a history of ripping out your foundation underneath you. One day you are on Python 3.8, then next day you are on Python 3.10 and all your packages are broken. MacPorts doesn't do that. Now, whether you should you be using the Homebrew Python is a completely different question. YMMV for other platforms managed via Homebrew. I've traditionally used MacPorts for…

pyenv has been standard tooling for far longer than uv. depending on package manager supplied Python packages only makes sense if you’re running rhel or Debian or something and your application is packaged/deployed/the maintenance path uses dnf/apt. Otherwise you should always use a venv and use an out of package manager update mechanism. Like, in a broader sense, vendoring dependencies only makes sense if you’re shipping an application, not on a dev box.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#342

Post by Geezus_42 »

srini-docker wrote: post #298

I work at Docker. Lot of valid and useful feedback here that we're looking closely at. One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms. Explained a bit more here about the architecture and why those choices were made: https://www.dock…

Sounds like what I'm doing with Nix and MicroVM currently.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#343

Post by theplumber »

atechboy wrote: post #326
srini-docker wrote: post #298

I work at Docker. Lot of valid and useful feedback here that we're looking closely at. One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms. Explained a bit more here about the architecture and why those choices were made: https://www.dock…

So the idea is to give each agent a VM to do several tool calls? or one VM for each tool call?

I think the idea is to have the agent run in the VM

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#344

Post by nextblock »

kstenerud wrote: post #227
rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

I wrote one that has both of those: yoloAI (MIT, Go, single binary, no login). https://github.com/kstenerud/yoloai Outbound firewall is `--network-isolated`: egress is denied except the agent's own API endpoints plus domains you allow, enforced sandbox-side (working on host-side enforcement now). `--network-none` if you want nothing. Credential brokering works the way you describe (currently Claude-only, I'll add mor…

[dead]

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#345

Post by katspaugh »

PufPufPuf wrote: post #203

I built "Locki": something similar but open-source! A bit different approach -- single VM with Incus containers -- focusing on speed of spinning up new sandboxes and integraton with git worktrees. The core grievance that motivated me was the lack of docker/kubernetes support in existing sandboxing tools, with Locki there's no chance of footguns like "two agents rebuild :latest tag at the same time". Give it a try: ht…

Looks cool!

I took a similar approach with https://runmachine.dev/ but later switched to OrbStack for iOS development.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#346

Post by teravor »

angry_octet wrote: post #239
cognitiveinline wrote: post #104

Earlier quoted context omitted.

BS. Unless we're talking 0-day/CVE, running an unprivileged container is as trustable as a VM. The only difference is how strictly you want to hold the memory/CPU bar. Infact on linux, containers are more lightweight than VMs. So yeah, not "vulnerable".

LLMs are great at finding 0-day, and people are rubbish at updating their containers and hosts to patch b-day. Containers have access to the kernel ABI, and as shown in the latest kernel exploits, all the memory handling surface that exposes. The virtualisation interface, offering fewer services, is significantly harder. Containers are obviously lighter than VMs, both to start and to schedule, but firecracker is pret…

gvisor's overhead is mostly IO. especially if you use the KVM backend.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#347

Post by Groxx »

bmurphy1976 wrote: post #338
dallen33 wrote: post #333

Earlier quoted context omitted.

How so?

The parent didn't go into any detail. I can. Homebrew has a history of ripping out your foundation underneath you. One day you are on Python 3.8, then next day you are on Python 3.10 and all your packages are broken. MacPorts doesn't do that. Now, whether you should you be using the Homebrew Python is a completely different question. YMMV for other platforms managed via Homebrew. I've traditionally used MacPorts for…

A lot of that is simply formula authors / application devs who don't know what they're doing (python@3.10 and other versions are a thing, and have been for quite a while now, but they're not always used and devs don't always keep track of the version they need) and people not updating their software for years (pythons are on a 5 year cycle everywhere, homebrew included: https://devguide.python.org/versions/ and https://formulae.brew.sh/formula/python@3.10 ).

Python in particular is well known to not be a stable target. For anyone. By design. If you expect long term use of a specific version of code, use a different language. It is not at all homebrew's fault that they're how many people discover that.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#348

Post by Grimburger »

frio wrote: post #40
Grimburger wrote: post #37

> Each agent runs inside a dedicated microVM with your dev environment What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts? Is it marketing fluff? Incus/LXD has had VM's for a long time now. incus launch images:ubuntu/26.04 my-ubuntu-vm --vm incus exec my-ubuntu-vm -- bash

It’s real VMs, firecracker style.

Haven't used docker sandbox but you can't just `apt install postgres` on firecracker, it needs to get baked into the image first.

That's my experience anyway, there's a lot of restrictions once you need to do some real basic things. For basic prompts maybe but interacting with a full stack ehh.

So bit hesitant to call firecracker a real VM myself.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#349

Post by followercode »

notsirius wrote: post #314
followercode wrote: post #287

Earlier quoted context omitted.

Hey, I work at Docker and my team works on mcp integration with sbx. A solution I've been trying is this: 1) Enable the xcode mcp server: https://developer.apple.com/documentation/xcode/giving-exter... 2) Add the xcode mcp server to sbx: `sbx mcp add xcode --command xcrun --args mcpbridge` 3) When you create the sandbox, use `--static-mcp xcode`. For example: `sbx create --static-mcp xcode claude .` Make sure you hav…

Also had this pain point as an sbx user. Given the risk this adds to the host, would be great if there were more docs on how to setup kits to make it safer (e.g. disable yolo mode).

This may help you: https://docs.docker.com/ai/sandboxes/governance/access-contr...

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#350

Post by filearts »

srini-docker wrote: post #298

I work at Docker. Lot of valid and useful feedback here that we're looking closely at. One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms. Explained a bit more here about the architecture and why those choices were made: https://www.dock…

Is there any line of sight to open sourcing the vmm?

Is it based on libkrun?

Post reply on HN