Docker has announced Docker Sandboxes, a new product that gives AI coding agents a disposable, isolated microVM environment to work in. The sandboxes are designed for safe, unattended execution of AI agents, letting them install packages, modify configs, and spin up their own Docker containers without touching the host system.
The announcement positions the product as a direct answer to a growing problem: AI coding agents often need permissive modes to work efficiently, but that freedom carries real security risks. Docker Sandboxes aim to remove that tradeoff entirely.
What Docker Sandboxes Do
Each agent runs inside a dedicated microVM. Only the project workspace is mounted into that microVM, so the host system remains untouched. Agents can install packages, run services, and work unattended, with no manual review, permission prompts, or supervision required.
The sandboxes are disposable by default and faster than VMs. They provide a real dev environment, meaning agents can do meaningful work, not just isolated tests. Agents can even use Docker within the sandboxes, spinning up additional containers safely.
Network and filesystem controls are customizable. For organizations that need stricter enforcement, Docker AI Governance adds network access policies, filesystem controls, and org-wide MCP governance. That companion product lets teams define controls once and enforce them everywhere.
Docker Desktop is not required to use sandboxes, which lowers the barrier for adoption.
Six Agents Supported at Launch
Docker Sandboxes support six AI coding agents out of the box: Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro. That covers agents from Anthropic, Google, GitHub/Microsoft, OpenAI, and the open-source community.
Getting started requires just a single command on each platform. On macOS, users run brew trust docker/tap && brew install docker/tap/sbx. On Windows, the command is winget install Docker.sbx.
The product page includes a demo video, a "Run Demo" button, a "Get started free" call-to-action, and a "Read the docs" link. There is also a "Talk to an expert" form, and the page closes with "Thank you for your interest. The Docker Team will be in touch."
YOLO Mode, Made Safe
The default mode for Docker Sandboxes is , dangerously-skip-permissions, commonly known as YOLO mode. That flag gives agents full autonomy with no approval prompts. It is essential for speed, but risky without guardrails.
Sandboxes make YOLO mode safe by isolating agents in microVMs. The hard security boundary keeps the host protected even when agents act unpredictably. That is the core argument of the announcement: agents can run fast without running wild, making speed and safety not a tradeoff.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
The distinction from traditional VMs matters here. Sandboxes run in microVMs, giving more isolation without the full cost of a VM. That combination of speed, isolation, and disposability is what Docker says makes the product suitable for unattended agent work.
Early Testimonials and Why It Matters
Two industry figures offered quotes in the announcement. Gavriel Cohen, creator of NanoClaw, said: "Docker has been ahead of the curve on security, and Docker Sandboxes is what infrastructure-level security looks like."
Ben Navetta, Engineering Lead at Warp, said: "Docker Sandboxes let agents have autonomy for long-running tasks without compromising safety. Warp is excited to integrate Sandboxes."
Warp, a terminal and development tool, is integrating the product. NanoClaw, an AI agent tool, also uses it. Both quotes reinforce the same theme: autonomy and safety can coexist when the infrastructure is right.
AI coding agents frequently require permissive modes to function effectively. Without them, agents stall on permission prompts and lose momentum. But granting that freedom on a host machine is dangerous, since a single bad command can damage the system.
Docker Sandboxes sit between those extremes. They give agents the autonomy they need for long-running tasks while keeping the host system isolated. The microVM boundary is the key technical feature, providing a hard security boundary that traditional process-level isolation cannot match.
The announcement also argues that organizations need infrastructure-level security for AI agents, not just per-agent safeguards. Docker AI Governance addresses that by centralizing network access policies, filesystem controls, and MCP governance. Teams can define controls once and enforce them everywhere, which is a significant shift from managing each agent individually.
The product page frames sandboxes as necessary for safe AI agent deployment, suggesting that without them, YOLO mode is simply too risky for production use. It also positions Docker Sandboxes as superior to traditional VMs for this specific use case, citing the microVM architecture as the reason.
Getting Started
Docker Sandboxes appear to be available now, though the announcement does not specify a formal availability date. The installation commands are straightforward, and the lack of a Docker Desktop requirement means users can start quickly.
The product page offers multiple entry points: a free tier, documentation, a demo, and direct contact with the Docker team. For organizations with stricter requirements, the AI Governance add-on provides the centralized controls needed for compliance.
The announcement is a product launch page rather than a technical deep dive, but it makes the value proposition clear. AI agents need room to work. Docker Sandboxes give them that room, safely.