Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

Post reply on HN
Print view View original

41–50 of 419 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#42

Post by dannyw »

I’d rather use another open source solution that doesn’t require a signup, and less likely to get rugpulled.

There is no reason to require a login for creating local mini sandboxes.

If you’re on Apple, native solutions like “container-machine init” come built in and are pretty good, if you’ll only be on Apple hardware.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#43

Post by crabmusket »

hokkos wrote: post #39

Wow, I hope one day Linux will be able to support the exclusive MacOs/Windows technology of Docker Sandboxes. (it's in the doc, but kinda strange to not see some instructions on the main page, probably distro related)

There's always https://github.com/mensfeld/code-on-incus

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#44

Post by tjoff »

embedding-shape wrote: post #31
zingar wrote: post #27

Earlier quoted context omitted.

Were you following any patterns/standards/advice on what you needed to protect against? Anything you can point the rest of us to?

You want to prevent the agent/others from reaching your home directory and other things. As long as you don't mount/sync directories/files from/to the container, so no mounting like "-v $(pwd):/app", but instead copy in, then when done, copy out. And of course, instead of doing the "copy in > copy out" process manually, get your local agent to write a bash script that does that for you, given what directory you're in…

What is the advantage of copying rather than a bind-mount?

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#45

Post by nicoty »

binsquare wrote: post #22
laserlight wrote: post #3

Requires login. Garbage.

I build a OSS lightweight, portable VM for those that don't want lock ins: https://github.com/smol-machines/smolvm

I have a solution based on Nix that can be used to generate reproducible container images: https://github.com/nothingnesses/agent-images . It lets you customise which agents, harnesses, or any other packages you want included in the VM and it uses `agent-box` for sandboxing.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#47

Post by matheusmoreira »

outof wrote: post #11

Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a hard sell.

I did the same thing. It was my first "vibecoded" project. I've been using it every day and it's great. I'm writing a custom Rust network stack for it right now. Gonna replace the current nftables firewall with it.

As for Docker Sandboxes, I'll just ask Sol literally right now to see what it does better than my virtdev, and then I'll improve virtdev instead of using Docker.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#48

Post by navigate8310 »

I just made my own devcontainer that I copy on any project and load whatever harness I want in that repo. Harnesss' config and auth are simply mounted from the host, so no setup required at all.

https://github.com/iodize6399/ai-devcontainer/tree/main/.dev...

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#49

Post by cyberpunk »

meffmadd wrote: post #33

I tried Docker Sandboxes but last time I checked you could not configure custom volume mounts, making more complex setups impossible. For work I need two directories for context for the agent to have access to…

put them both inside another directory and share that? what am i missing?
Post reply on HN