Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Docker Sandboxes – Disposable, isolated sandboxes for AI agents

docker.com

Post reply on HN
Print view View original

151–160 of 450 posts

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#151

Post by RagnarD »

TheqO wrote: post #115
Grimburger wrote: post #37

> Each agent runs inside a dedicated microVM with your dev environment What's a "microVM" and what's the security model here compared to using real virtual machines with actual constraints on breakouts? Is it marketing fluff? Incus/LXD has had VM's for a long time now. incus launch images:ubuntu/26.04 my-ubuntu-vm --vm incus exec my-ubuntu-vm -- bash

There are many devs that have little to no experience of Linux, like the hundreds of thousands of .Net and Java CRUD devs in enterprise companies using Windows. There is a need for a Docker desktop like GUI for this market.

Huh? https://docs.docker.com/desktop/setup/install/windows-instal...

Also, WSL (Windows Subsystem for Linux) has been baked into Windows for a long time and makes it very easy to play with Linux, as does using the Hyper-V VM system. Any developer unfamiliar with Linux because they use Windows, has little excuse.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#153

Post by LeBit »

Hugsun wrote: post #59
Schlagbohrer wrote: post #52

Can someone more versed in Docker explain to me how this is different than building my own docker container from a Dockerfile for using Pi agent harness? That's what I do currently. I use Docker Desktop in windows as the backend for that.

Docker containers use Linux kernel features to create an isolated environment, running on the same machine as docker is. This creates a virtual machine, with its own kernel, and runs the container in there. This gives stronger isolation and security guarantees.

When the host is a Mac or window , docker always run in a VM anyway.

On Linux, you can run docker directly on the host, but you can also very easily setup a vm with incus and run docker from there.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#154

Post by rpoisel »

rusch wrote: post #58

The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol…

Don't want to say it's better, but I implemented Agent Circus (https://github.com/Embedded-Focus/agent-circus) which allows to lock AI agent harnesses into docker containers.

I'm using it as my main driver since months.

Support for running agent harnesses in unprivileged podman containers is on my feature list. :-)

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#155

Post by LeBit »

fergie wrote: post #112

I use it (sbx), but I don't 100% trust that it actually works, and I would prefer something open source where the limits of the sandboxing could be tested and explored. Maybe we should just ssh into separate development machines to ensure real and verifiable sandboxing? (as was totally standard before Docker became a thing)

You should research bubblewrap and nono.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#156

Post by ShinyLeftPad »

defraxi wrote: post #140
sureglymop wrote: post #72

What is the main benefit over doing something like: docker run --runtime krun --rm -it -v $(pwd):/workspace/$(basename $(pwd)) -w /workspace/$(basename $(pwd)) --network restricted-net ghcr.io/openai/codex-universal:latest sh That runs the codex OCI in a qemu microvm. From what I can see, more fine grained network and filesystem access control as well as convenience?

The credentials part... https://docs.docker.com/ai/sandboxes/security/credentials/

It seems to do a good job of not stating the actual threat model anywhere.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#157

Post by LeBit »

nopurpose wrote: post #94
quotemstr wrote: post #71

Earlier quoted context omitted.

Doesn't everyone do this now? It's hardly a new idea. Yet every time someone proposes the idea, people fawn over it and proclaim it the best thing ever. Yes, you can inject tokens via a proxy. What else is new?

Who is doing it as first class feature with at least adequate UX? I have skimmed alternatives offered in comments to this post (vibepod-cli, code-on-incus, opencode-docker, sandboxy, smolvm, amazing-sandbox) and none of them seem to do credentials injection at the proxy level.

nono.

Also fnox now does credentials proxying.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#158

Post by dejw »

pkhamre wrote: post #36

I started building my own isolated and security-hardened docker image for OpenCode about half a year ago. Been using it daily. https://github.com/pkhamre/opencode-docker

if I was paranoid about security I wouldn't use docker in the first place.

Re: Docker Sandboxes – Disposable, isolated sandboxes for AI agents

#159

Post by anentropic »

navigate8310 wrote: post #48

I just made my own devcontainer that I copy on any project and load whatever harness I want in that repo. Harnesss' config and auth are simply mounted from the host, so no setup required at all. https://github.com/iodize6399/ai-devcontainer/tree/main/.dev...

Yeah I also recently started using devcontainers for this

I quite like the 'features' layer system, adding extra tools to container in a declarative plugin-like way

Being able to 'safely' run with skip permissions has been a gamechanger

Post reply on HN