srini-docker
Joined 9 months ago
Karma
84
Submissions
8
Member since
Jan 16
Recent submissions
Comment · 2 months ago
Yes!
Comment · 2 months ago
Quick update: webpage reflects Linux support as well, thanks for the flag.
Comment · 2 months ago
Linux is available today (Ubuntu): github.com/docker/sbx-releases. Our webpage showing only brew and winget is on us.
For the people upthread who asked about on customization: templates (like snapshotting a running sandbox) and kits (YAML applied at creation like install steps, files, network and credential rules, or define a new agent outright) are the supported path now. It's early but take a look here: https://docs.docker.com/ai/sandboxes/customize/
On MCP, since credential handling was mentioned here: the sandbox sees one gateway endpoint, and OAuth tokens stay in the host credential store rather than in the VM. https://docs.docker.com/ai/sandboxes/mcp-gateway/
All this is early. We're looking at more based on feedback from users like running sandboxes in the background for long-horizon work and a lot more (including what you all raised in the thread here). Keep them coming.
Comment · 2 months ago
I work at Docker. Lot of valid and useful feedback here that we're looking closely at.
One correction: this isn't containers. Each session is a microVM with its own kernel on the platform's native hypervisor: Hypervisor.framework, WHP, KVM. We wrote a new VMM (not Firecracker) to make it more effective across platforms.
Explained a bit more here about the architecture and why those choices were made: https://www.docker.com/blog/why-microvms-the-architecture-be...
Comment · 9 months ago
Neat approach. Also, we're seeing a number of approaches to sandboxing every day now. Got me thinking about why we're seeing this resurgence. Thoughts?
I think a lot of this current sandboxing interest is coming from a break in assumptions. Traditional security mostly assumed a human was driving. Actions are chained together slowly and there’s time to notice and intervene. Agents have root access/tons of privilege but they execute at machine speed. The controls (firewalls/IAM) all still “work,” but the thing they were implicitly relying on (human judgment + hesitation) isn’t there anymore.
Since that assumption went away, we're all looking for ways to contain this risk + limiting what can happen if the coding agent does something unintended. Seeing a lot of people turn toward containers, VMs, and other variants of them for this.
Full disclosure: I’m at Docker. We’ve seen a lot of developers immediately reach for Docker as a quick way to fence agents in. This pushed us to build Docker Sandboxes, specifically for coding agents. It’s early, and we’re iterating, including moving toward microVM-based isolation and network access controls soon (update within weeks).
Comment · 9 months ago
Hey - Srini from Docker here. We’ve seen a lot of developers turn to Docker for this use case and heard some mentions of the Docker-in-Docker block. We put out Docker Sandboxes in experimental preview as a potential answer. Still early but we're working on the next iteration based on MicroVMs and avoids Docker-in-Docker.