Docker Sandboxes 101: run Claude Code in isolated microVMs, command by command
ghumare64 · x · 2026-11-02
Docker highlights a hands-on guide to Docker Sandboxes (sbx v0.47.0) and Docker Agent (docker-agent v1.149.0) for running untrusted coding agents on real repos safely.
Key points:
- Each agent runs in its own microVM; model calls egress through a host proxy and in-container provider keys are placeholders, so credentials never reach the agent.
- sbx policy controls what agents can reach, and every line of sbx policy log shows which rule allowed or blocked a connection; sbx secret handles credentials, sbx mcp adds MCP support.
- Kits and sbenv.yaml configure environments; Agent Files orchestrate agent teams over local tools and a local model, with recording and cassette-based replay.
- Every command output in the manual comes from one recorded run.
Useful for anyone running Claude Code or Codex on real repositories while protecting credentials and access.
More from coding & agent
- Together launches post-training platform aligning RL training with serving — togethercompute · 2026-11-02
- Five controls that keep LangGraph agents alive in production: 15% of chats routed to humans — LangChain · 2026-11-02
- Building a Company OS on Claude Code: skills run in 21-85s at $0.08-0.32 per task — aakashgupta · 2026-11-02
- Building a local tool to give agents access to ReMarkable notes, skipping third-party MCPs — annetgriffin · 2026-11-02
- Developer shares hard-won lessons on publishing Android apps to Chinese app stores — dotey · 2026-11-02
- AI Researcher jxnlco Solicits Real Projects Using Models for Physical Engineering and CAD — jxnlco · 2026-11-02