I tried Docker Sandboxes but last time I checked you could not configure custom volume mounts, making more complex setups impossible. For work I need two directories for context for the agent to have access to…
[deleted]
Docker Sandboxes – Disposable, isolated sandboxes for AI agents
81–90 of 442 posts
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#82I got excited for this not because this didn't exist before, but because Docker putting their weight on this would imply a broader adoption and better integration in the industry. I am sad that they are asking for a login here though, which doesn't make any sense to me.
microVMs (firecracker) have existed for years. This is not new.
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#83On Linux, you can skip Docker and use bubblewrap. Some inspiration: https://blog.gpkb.org/posts/ai-agent-sandbox/
Bubble wrap is just containerisation no?
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#84Earlier quoted context omitted.
I have the same question as GP. Your answer helps a little but not really. I might be naive, but I was under the impression that malicious code escaping a docker image and running amok on my host system was not something I should be too worried about. Especially if I run docker in rootless mode. Is that wrong? For clarity I’m actually using podman, not Docker.
Oh no, you should definitely be worried about that. Podman might make it harder to escalate to host root, or manipulate other containers, but it is still vulnerable. Now I'm curious to know how hardened the Docket Sandbox orchestration interface is. I guess we can assume they have run Mythos against it for a few weeks maybe? It's unclear.
Unsettling. I mean, is there any reasonable way to develop software in 2026? I've already sworn off ever installing npm directly on my host. Containerizing everything is laborious enough, but running a separate VM for everything?
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#85The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
Eclipse Enclave does exactly that: There is an outbound firewall and secret injections, so that the agent never sees a real key. And it's fully open source: https://github.com/eclipse-enclave/enclave
Looking at the Readme it seems like it only supports docker. Which is a dealbreaker for some
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#86Earlier quoted context omitted.
I build a OSS lightweight, portable VM for those that don't want lock ins: https://github.com/smol-machines/smolvm
This looks like gvisor but is a vm like firecracker right? Any reason you did not want to use firecracker? (I am testing this now as a backend for my pet project which currently supports firecracker and gvisor. No network.)
It's a batteries included alternative to firecracker with a couple of new ideas tossed into the mix i.e. portable like a container (bake into a single file and rehydrate the vm anywhere), dynamic resource allocation, etc.
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#87The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
Does secret injection really prevent that the agent send my GitHub key somewhere? If it has access to it via env var, can it not just paste it somewhere?
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#88The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…
I havent used nor gondolin neither docker's solution, but curious to know what gondolin is missing (evaluating both for my personal use)? is it only the DX or something else, if DX, can you what exactly is missing?
thanks
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#89Like many people, I suspect, I used Claude to write my own agent sandbox that suits my needs very well. Investing my time in a propietary product has become a hard sell.
Why developers will never pay for their tools.
Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents
#90I wish they solved the issue happening for years on MacOS where Docker keeps up eating all available free space and ends up requiring restart of the whole machine, instead of Gordon and other useless shit.