Docker Is Not a Real Sandbox for Agent Code: From Containers to microVMs
aidenclarke_12 · reddit · 2026-08-27
The author argues most agent nightmares — deleting repos, wiping emails via prompt injection, poisoned CI runners — trace back to model-written code running with real host access.
Isolation tiers:
- Docker with mounted dirs: fine solo with backups, but it shares the host kernel; prompt injection can still reach mounts and network. Not a security boundary.
- Bubblewrap / Podman / selective mounts: better hygiene, same shared-kernel story.
- gVisor: user-space kernel, a decent middle ground.
- microVMs (Firecracker, Kata on KVM): their own virtualized hardware, so a breakout doesn't land on your host — the real hardware boundary.
Verdict: Docker + backups is fine on a laptop; once you ship a run-this-code feature, run agent code in CI, or operate at scale, move to microVMs — self-operated Firecracker/Kata or a hosted microvm sandbox.
More from coding & agent
- llama.cpp Underuses Your NVMe Array? The Author Lets Kimi Tweak the Code — carrigmat · 2026-08-27
- Agno Launches: A 'Self-Building' Agent Platform for the Cloud — pritisinghhhh · 2026-08-27
- OpenMythos: open-source theoretical reconstruction of Claude's architecture hits 14.8k stars — Shruti_0810 · 2026-08-27
- Agent Opens Bambu Handy App on Phone to Reprint Job — haydendevs · 2026-08-27
- GitHub Copilot Teams update released with Slack integration — marlene_zw · 2026-08-27
- Skill routers like /ask-matt are unreasonably useful for internal dev training — mattpocockuk · 2026-08-27