{"slug": "docker-sandboxes", "name": "Docker Sandboxes", "category": "security", "category_name": "Security and passwords", "description": "Docker's microVM-based sandbox for running AI coding agents isolated from the host machine.", "recommenders": 6, "commenters": 11, "warners": 1, "score": 5.81, "rising": 3.35, "first": "2026-02-27", "latest": "2026-09-20", "why": "HN commenters use it as a ready-made microVM sandbox for coding agents that works out of the box, with an outbound firewall and secret injection that replace hand-rolled setups.", "why_is_quote": false, "has_verdict": true, "sentiment": {"recommend": 6, "neutral": 4, "compare": 0, "warn": 1}, "spark": [0, 0, 0, 1, 0, 0, 0, 0, 1, 3, 1, 0], "listed": true, "loved": ["Works out of box", "MicroVM isolation"], "caveat": "Closed source", "short_quote": "Recently I moved to Docker Sandboxes. This removed most of what I was having to hand roll.", "icon": true, "domain": "docker.com", "github_repo": null, "official_url": "https://docs.docker.com/ai/sandboxes/", "pricing": "unknown", "aliases": ["Docker Sandboxes", "Docker sandboxes"], "verdict": [{"text": "HN commenters use it as a ready-made microVM sandbox for coding agents", "cites": [{"id": 754971248, "item_id": 47185703, "url": "https://news.ycombinator.com/item?id=47185703", "by": "stefans", "date": "2026-02-27", "stance": "recommend", "quote": "switched to Docker sandboxes since they switched to mircoVMs too", "excerpt": "Looked into Apples container framework first (for proper isolation) but switched to Docker sandboxes since they switched to mircoVMs too: https://docs.docker.com/ai/sandboxes/#why-use-docker-sandboxes", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "Apple container framework", "story": "Let's Discuss Sandbox Isolation"}, {"id": 792945889, "item_id": 49559118, "url": "https://news.ycombinator.com/item?id=49559118", "by": "verdverm", "date": "2026-09-04", "stance": "neutral", "quote": "Docker also has a sandbox (microvm based) product now.", "excerpt": "I used dagger for the sandbox in my personal harness. Docker also has a sandbox (microvm based) product now. Both obscure the credentials, but I do not think it eliminates them base64 encoding it (or some other transformation). It does step it from being visible if it is the same string, regardless where/how it is printed. Service accounts / IAM / WIF / proxies, which remove credentials from the environment all toget", "context": "", "use_case": "agent sandbox", "switched_from": "", "story": "Ask HN: How do you gate an autonomous coding agent's shell access?"}, {"id": 788935364, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "recommend", "quote": "Docker sandboxes seem to be a good solution that also employs virtualization.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "isolating dev tools", "switched_from": "", "story": "Firefox is now the last major browser that still supports uBlock Origin"}]}, {"text": " that works out of the box, with an outbound firewall and secret injection that replace hand-rolled setups.", "cites": [{"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 796493376, "item_id": 49780836, "url": "https://news.ycombinator.com/item?id=49780836", "by": "DubiousPusher", "date": "2026-09-20", "stance": "recommend", "quote": "Recently I moved to Docker Sandboxes. This removed most of what I was having to hand roll.", "excerpt": "I hand rolled a sandbox with credential injections on call out using WSL and mitm and Windows credential manager. The only credential I had to have in the box was a fine grained PAT with copilot response. I used some hacky git push/pull to move work in and out of the sandbox. For collaborative UX review I would switch the agent to limited perms and CDP back to my host browser. Recently I moved to Docker Sandboxes. Th", "context": "", "use_case": "sandboxing coding agents", "switched_from": "hand-rolled WSL sandbox", "story": "Software sandboxing: The basics (2025)"}, {"id": 782934096, "item_id": 48933381, "url": "https://news.ycombinator.com/item?id=48933381", "by": "doringeman", "date": "2026-07-16", "stance": "recommend", "quote": "You can run it using Docker Sandboxes", "excerpt": "You can run it using Docker Sandboxes: https://github.com/docker/sbx-kits-contrib/pull/156. Doesn't replace reading the code, but `sbx policy log` shows every request the network policy blocked or allowed, and combined with an explicit allowlist, that gives you a meaningfully more secure environment to run it in.", "context": "", "use_case": "sandbox for running Grok Build", "switched_from": "", "story": "Grok Build Is OSS"}]}, {"text": " The most common complaints are that it is closed source and needs repeated logins,", "cites": [{"id": 787872560, "item_id": 49242035, "url": "https://news.ycombinator.com/item?id=49242035", "by": "celrenheit", "date": "2026-08-10", "stance": "warn", "quote": "I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source", "excerpt": "I tried it and it worked great at first but I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source and not possible to customize to my need. One other thing, I want to be able to handle multiple repos in the same sandbox and have a standard workflow around worktrees (one worktree per repo, all the worktree mounted in the VM). ", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787856224, "item_id": 49241014, "url": "https://news.ycombinator.com/item?id=49241014", "by": "fergie", "date": "2026-08-10", "stance": "neutral", "quote": "I use it (sbx), but I don't 100% trust that it actually works", "excerpt": "I use it (sbx), but I don't 100% trust that it actually works, and I would prefer something open source where the limits of the sandboxing could be tested and explored. Maybe we should just ssh into separate development machines to ensure real and verifiable sandboxing? (as was totally standard before Docker became a thing)", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}, {"text": " and some users doubt how well its isolation holds up.", "cites": [{"id": 787856224, "item_id": 49241014, "url": "https://news.ycombinator.com/item?id=49241014", "by": "fergie", "date": "2026-08-10", "stance": "neutral", "quote": "I use it (sbx), but I don't 100% trust that it actually works", "excerpt": "I use it (sbx), but I don't 100% trust that it actually works, and I would prefer something open source where the limits of the sandboxing could be tested and explored. Maybe we should just ssh into separate development machines to ensure real and verifiable sandboxing? (as was totally standard before Docker became a thing)", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}], "praise": [{"label": "Works out of box", "summary": "Several users call it a daily driver that works well without much setup.", "quotes": [{"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787839824, "item_id": 49239989, "url": "https://news.ycombinator.com/item?id=49239989", "by": "notsirius", "date": "2026-08-09", "stance": "recommend", "quote": "been using this for a while - works great!", "excerpt": "been using this for a while - works great! Has also had a lot of updates over the past year so worth checking out again if you tried it a while ago", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 796493376, "item_id": 49780836, "url": "https://news.ycombinator.com/item?id=49780836", "by": "DubiousPusher", "date": "2026-09-20", "stance": "recommend", "quote": "Recently I moved to Docker Sandboxes. This removed most of what I was having to hand roll.", "excerpt": "I hand rolled a sandbox with credential injections on call out using WSL and mitm and Windows credential manager. The only credential I had to have in the box was a fine grained PAT with copilot response. I used some hacky git push/pull to move work in and out of the sandbox. For collaborative UX review I would switch the agent to limited perms and CDP back to my host browser. Recently I moved to Docker Sandboxes. Th", "context": "", "use_case": "sandboxing coding agents", "switched_from": "hand-rolled WSL sandbox", "story": "Software sandboxing: The basics (2025)"}]}, {"label": "MicroVM isolation", "summary": "Users value that it isolates workloads with microVMs rather than shared-kernel containers.", "quotes": [{"id": 754971248, "item_id": 47185703, "url": "https://news.ycombinator.com/item?id=47185703", "by": "stefans", "date": "2026-02-27", "stance": "recommend", "quote": "switched to Docker sandboxes since they switched to mircoVMs too", "excerpt": "Looked into Apples container framework first (for proper isolation) but switched to Docker sandboxes since they switched to mircoVMs too: https://docs.docker.com/ai/sandboxes/#why-use-docker-sandboxes", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "Apple container framework", "story": "Let's Discuss Sandbox Isolation"}, {"id": 788935364, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "recommend", "quote": "Docker sandboxes seem to be a good solution that also employs virtualization.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "isolating dev tools", "switched_from": "", "story": "Firefox is now the last major browser that still supports uBlock Origin"}, {"id": 792945889, "item_id": 49559118, "url": "https://news.ycombinator.com/item?id=49559118", "by": "verdverm", "date": "2026-09-04", "stance": "neutral", "quote": "Docker also has a sandbox (microvm based) product now.", "excerpt": "I used dagger for the sandbox in my personal harness. Docker also has a sandbox (microvm based) product now. Both obscure the credentials, but I do not think it eliminates them base64 encoding it (or some other transformation). It does step it from being visible if it is the same string, regardless where/how it is printed. Service accounts / IAM / WIF / proxies, which remove credentials from the environment all toget", "context": "", "use_case": "agent sandbox", "switched_from": "", "story": "Ask HN: How do you gate an autonomous coding agent's shell access?"}]}, {"label": "Network policy", "summary": "An outbound firewall with an allowlist and request log limits what sandboxed code can reach.", "quotes": [{"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 782934096, "item_id": 48933381, "url": "https://news.ycombinator.com/item?id=48933381", "by": "doringeman", "date": "2026-07-16", "stance": "recommend", "quote": "You can run it using Docker Sandboxes", "excerpt": "You can run it using Docker Sandboxes: https://github.com/docker/sbx-kits-contrib/pull/156. Doesn't replace reading the code, but `sbx policy log` shows every request the network policy blocked or allowed, and combined with an explicit allowlist, that gives you a meaningfully more secure environment to run it in.", "context": "", "use_case": "sandbox for running Grok Build", "switched_from": "", "story": "Grok Build Is OSS"}]}, {"label": "Secret injection", "summary": "Credentials are injected through placeholders instead of being stored in the sandbox.", "quotes": [{"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 796493376, "item_id": 49780836, "url": "https://news.ycombinator.com/item?id=49780836", "by": "DubiousPusher", "date": "2026-09-20", "stance": "recommend", "quote": "Recently I moved to Docker Sandboxes. This removed most of what I was having to hand roll.", "excerpt": "I hand rolled a sandbox with credential injections on call out using WSL and mitm and Windows credential manager. The only credential I had to have in the box was a fine grained PAT with copilot response. I used some hacky git push/pull to move work in and out of the sandbox. For collaborative UX review I would switch the agent to limited perms and CDP back to my host browser. Recently I moved to Docker Sandboxes. Th", "context": "", "use_case": "sandboxing coding agents", "switched_from": "hand-rolled WSL sandbox", "story": "Software sandboxing: The basics (2025)"}, {"id": 792945889, "item_id": 49559118, "url": "https://news.ycombinator.com/item?id=49559118", "by": "verdverm", "date": "2026-09-04", "stance": "neutral", "quote": "Docker also has a sandbox (microvm based) product now.", "excerpt": "I used dagger for the sandbox in my personal harness. Docker also has a sandbox (microvm based) product now. Both obscure the credentials, but I do not think it eliminates them base64 encoding it (or some other transformation). It does step it from being visible if it is the same string, regardless where/how it is printed. Service accounts / IAM / WIF / proxies, which remove credentials from the environment all toget", "context": "", "use_case": "agent sandbox", "switched_from": "", "story": "Ask HN: How do you gate an autonomous coding agent's shell access?"}]}, {"label": "Git integration", "summary": "Its git setup makes moving work in and out of the sandbox easy.", "quotes": [{"id": 796493376, "item_id": 49780836, "url": "https://news.ycombinator.com/item?id=49780836", "by": "DubiousPusher", "date": "2026-09-20", "stance": "recommend", "quote": "Recently I moved to Docker Sandboxes. This removed most of what I was having to hand roll.", "excerpt": "I hand rolled a sandbox with credential injections on call out using WSL and mitm and Windows credential manager. The only credential I had to have in the box was a fine grained PAT with copilot response. I used some hacky git push/pull to move work in and out of the sandbox. For collaborative UX review I would switch the agent to limited perms and CDP back to my host browser. Recently I moved to Docker Sandboxes. Th", "context": "", "use_case": "sandboxing coding agents", "switched_from": "hand-rolled WSL sandbox", "story": "Software sandboxing: The basics (2025)"}, {"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}], "caveats": [{"label": "Closed source", "summary": "Being closed source makes it hard to customize or to verify how well the sandbox isolates.", "quotes": [{"id": 787872560, "item_id": 49242035, "url": "https://news.ycombinator.com/item?id=49242035", "by": "celrenheit", "date": "2026-08-10", "stance": "warn", "quote": "I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source", "excerpt": "I tried it and it worked great at first but I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source and not possible to customize to my need. One other thing, I want to be able to handle multiple repos in the same sandbox and have a standard workflow around worktrees (one worktree per repo, all the worktree mounted in the VM). ", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787856224, "item_id": 49241014, "url": "https://news.ycombinator.com/item?id=49241014", "by": "fergie", "date": "2026-08-10", "stance": "neutral", "quote": "I use it (sbx), but I don't 100% trust that it actually works", "excerpt": "I use it (sbx), but I don't 100% trust that it actually works, and I would prefer something open source where the limits of the sandboxing could be tested and explored. Maybe we should just ssh into separate development machines to ensure real and verifiable sandboxing? (as was totally standard before Docker became a thing)", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}, {"label": "Repeated logins", "summary": "Users have to log in separately for each sandbox.", "quotes": [{"id": 787872560, "item_id": 49242035, "url": "https://news.ycombinator.com/item?id=49242035", "by": "celrenheit", "date": "2026-08-10", "stance": "warn", "quote": "I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source", "excerpt": "I tried it and it worked great at first but I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source and not possible to customize to my need. One other thing, I want to be able to handle multiple repos in the same sandbox and have a standard workflow around worktrees (one worktree per repo, all the worktree mounted in the VM). ", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}, {"label": "Limited flexibility", "summary": "Some users built their own tools after finding it hard to adapt to multi-repo or custom workflows.", "quotes": [{"id": 787872560, "item_id": 49242035, "url": "https://news.ycombinator.com/item?id=49242035", "by": "celrenheit", "date": "2026-08-10", "stance": "warn", "quote": "I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source", "excerpt": "I tried it and it worked great at first but I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source and not possible to customize to my need. One other thing, I want to be able to handle multiple repos in the same sandbox and have a standard workflow around worktrees (one worktree per repo, all the worktree mounted in the VM). ", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787851344, "item_id": 49240709, "url": "https://news.ycombinator.com/item?id=49240709", "by": "3371", "date": "2026-08-10", "stance": "neutral", "quote": "I used this for a while then decided to build my own suites", "excerpt": "I used this for a while then decided to build my own suites that pack individual harness and respective host state (config, plugins, skills, etc.) into an image. Works better and much flexible in my opinion.", "context": "", "use_case": "sandboxing agent harnesses", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}, {"label": "Disk usage", "summary": "One user saw its disk space usage grow significantly.", "quotes": [{"id": 787872560, "item_id": 49242035, "url": "https://news.ycombinator.com/item?id=49242035", "by": "celrenheit", "date": "2026-08-10", "stance": "warn", "quote": "I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source", "excerpt": "I tried it and it worked great at first but I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source and not possible to customize to my need. One other thing, I want to be able to handle multiple repos in the same sandbox and have a standard workflow around worktrees (one worktree per repo, all the worktree mounted in the VM). ", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}]}, {"label": "Token renewal", "summary": "Renewing short-lived tokens is still left to the user.", "quotes": [{"id": 796493376, "item_id": 49780836, "url": "https://news.ycombinator.com/item?id=49780836", "by": "DubiousPusher", "date": "2026-09-20", "stance": "recommend", "quote": "Recently I moved to Docker Sandboxes. This removed most of what I was having to hand roll.", "excerpt": "I hand rolled a sandbox with credential injections on call out using WSL and mitm and Windows credential manager. The only credential I had to have in the box was a fine grained PAT with copilot response. I used some hacky git push/pull to move work in and out of the sandbox. For collaborative UX review I would switch the agent to limited perms and CDP back to my host browser. Recently I moved to Docker Sandboxes. Th", "context": "", "use_case": "sandboxing coding agents", "switched_from": "hand-rolled WSL sandbox", "story": "Software sandboxing: The basics (2025)"}]}], "who": [], "tags": ["for AI coding agents", "for git worktree workflows", "for macOS users"], "use_cases": ["sandboxing ai agents", "sandboxing coding agents", "agent sandbox", "isolating dev tools", "isolated sandboxes for ai agents", "sandboxing agent harnesses"], "compared": [], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=49239751", "title": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents", "mentions": 6}, {"url": "https://news.ycombinator.com/item?id=49778670", "title": "Software sandboxing: The basics (2025)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49556858", "title": "Ask HN: How do you gate an autonomous coding agent's shell access?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49303202", "title": "Firefox is now the last major browser that still supports uBlock Origin", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48926590", "title": "Grok Build Is OSS", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47184049", "title": "Let's Discuss Sandbox Isolation", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {"recommend": 1}, "2026-03": {}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {"recommend": 1}, "2026-08": {"recommend": 3, "neutral": 3, "warn": 1}, "2026-09": {"neutral": 1, "recommend": 1}, "2026-10": {}}, "quotes": [{"id": 796493376, "item_id": 49780836, "url": "https://news.ycombinator.com/item?id=49780836", "by": "DubiousPusher", "date": "2026-09-20", "stance": "recommend", "quote": "Recently I moved to Docker Sandboxes. This removed most of what I was having to hand roll.", "excerpt": "I hand rolled a sandbox with credential injections on call out using WSL and mitm and Windows credential manager. The only credential I had to have in the box was a fine grained PAT with copilot response. I used some hacky git push/pull to move work in and out of the sandbox. For collaborative UX review I would switch the agent to limited perms and CDP back to my host browser. Recently I moved to Docker Sandboxes. Th", "context": "", "use_case": "sandboxing coding agents", "switched_from": "hand-rolled WSL sandbox", "story": "Software sandboxing: The basics (2025)"}, {"id": 792945889, "item_id": 49559118, "url": "https://news.ycombinator.com/item?id=49559118", "by": "verdverm", "date": "2026-09-04", "stance": "neutral", "quote": "Docker also has a sandbox (microvm based) product now.", "excerpt": "I used dagger for the sandbox in my personal harness. Docker also has a sandbox (microvm based) product now. Both obscure the credentials, but I do not think it eliminates them base64 encoding it (or some other transformation). It does step it from being visible if it is the same string, regardless where/how it is printed. Service accounts / IAM / WIF / proxies, which remove credentials from the environment all toget", "context": "", "use_case": "agent sandbox", "switched_from": "", "story": "Ask HN: How do you gate an autonomous coding agent's shell access?"}, {"id": 788935364, "item_id": 49308460, "url": "https://news.ycombinator.com/item?id=49308460", "by": "matheusmoreira", "date": "2026-08-15", "stance": "recommend", "quote": "Docker sandboxes seem to be a good solution that also employs virtualization.", "excerpt": "QEMU virtual machines. Sandboxes like firejail and bubblewrap share a kernel: attacker is one exploit away from root. Hypervisors present an infinitely smaller attack surface, and if they're ever defeated the entire industry is done, not just me. I have a base system image that gets forked off into delta qcow2 images for every project I'm working on or whatever ephemeral execution context I need. I started a side pro", "context": "", "use_case": "isolating dev tools", "switched_from": "", "story": "Firefox is now the last major browser that still supports uBlock Origin"}, {"id": 788049968, "item_id": 49253123, "url": "https://news.ycombinator.com/item?id=49253123", "by": "kylequest", "date": "2026-08-10", "stance": "neutral", "quote": "TLDR facts about Docker Sandboxes (based on its install)", "excerpt": "TLDR facts about Docker Sandboxes (based on its install): Uses ContainerD compiled natively for Mac OS and uses Nerdbox for the VMs: \u251c\u2500\u2500 bin \u2502 \u2514\u2500\u2500 sbx \u251c\u2500\u2500 libexec \u2502 \u251c\u2500\u2500 containerd-shim-nerdbox-v1 <- Nerbox integration for ContainerD \u2502 \u251c\u2500\u2500 mkfs.erofs \u2502 \u251c\u2500\u2500 mkfs.ext4 \u2502 \u251c\u2500\u2500 nerdbox-kernel-arm64 \u2502 \u2514\u2500\u2500 nerdbox-rootfs-arm64.erofs More info about Nerdbox is here https://github.com/containerd/nerdbox", "context": "", "use_case": "isolated sandboxes for AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787872560, "item_id": 49242035, "url": "https://news.ycombinator.com/item?id=49242035", "by": "celrenheit", "date": "2026-08-10", "stance": "warn", "quote": "I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source", "excerpt": "I tried it and it worked great at first but I had multiple issues with it, the disk space usage was growing significantly, I need to login multiple times for each sandbox, it's closed source and not possible to customize to my need. One other thing, I want to be able to handle multiple repos in the same sandbox and have a standard workflow around worktrees (one worktree per repo, all the worktree mounted in the VM). ", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787856224, "item_id": 49241014, "url": "https://news.ycombinator.com/item?id=49241014", "by": "fergie", "date": "2026-08-10", "stance": "neutral", "quote": "I use it (sbx), but I don't 100% trust that it actually works", "excerpt": "I use it (sbx), but I don't 100% trust that it actually works, and I would prefer something open source where the limits of the sandboxing could be tested and explored. Maybe we should just ssh into separate development machines to ensure real and verifiable sandboxing? (as was totally standard before Docker became a thing)", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787851344, "item_id": 49240709, "url": "https://news.ycombinator.com/item?id=49240709", "by": "3371", "date": "2026-08-10", "stance": "neutral", "quote": "I used this for a while then decided to build my own suites", "excerpt": "I used this for a while then decided to build my own suites that pack individual harness and respective host state (config, plugins, skills, etc.) into an image. Works better and much flexible in my opinion.", "context": "", "use_case": "sandboxing agent harnesses", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787848720, "item_id": 49240545, "url": "https://news.ycombinator.com/item?id=49240545", "by": "rusch", "date": "2026-08-10", "stance": "recommend", "quote": "this has been my daily driver for a while now because it works great out of the box", "excerpt": "The login is annoying but, lacking an open source alternative, this has been my daily driver for a while now because it works great out of the box with two key features: outbound firewall and secret injection with placeholders. I run it with superset and then each git worktree is mounted in a sandbox that is configured for each repo i work in. Closest open source I have seen is https://earendil-works.github.io/gondol", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 787839824, "item_id": 49239989, "url": "https://news.ycombinator.com/item?id=49239989", "by": "notsirius", "date": "2026-08-09", "stance": "recommend", "quote": "been using this for a while - works great!", "excerpt": "been using this for a while - works great! Has also had a lot of updates over the past year so worth checking out again if you tried it a while ago", "context": "", "use_case": "sandboxing AI agents", "switched_from": "", "story": "Docker Sandboxes \u2013 Disposable, isolated sandboxes for AI agents"}, {"id": 782934096, "item_id": 48933381, "url": "https://news.ycombinator.com/item?id=48933381", "by": "doringeman", "date": "2026-07-16", "stance": "recommend", "quote": "You can run it using Docker Sandboxes", "excerpt": "You can run it using Docker Sandboxes: https://github.com/docker/sbx-kits-contrib/pull/156. Doesn't replace reading the code, but `sbx policy log` shows every request the network policy blocked or allowed, and combined with an explicit allowlist, that gives you a meaningfully more secure environment to run it in.", "context": "", "use_case": "sandbox for running Grok Build", "switched_from": "", "story": "Grok Build Is OSS"}, {"id": 754971248, "item_id": 47185703, "url": "https://news.ycombinator.com/item?id=47185703", "by": "stefans", "date": "2026-02-27", "stance": "recommend", "quote": "switched to Docker sandboxes since they switched to mircoVMs too", "excerpt": "Looked into Apples container framework first (for proper isolation) but switched to Docker sandboxes since they switched to mircoVMs too: https://docs.docker.com/ai/sandboxes/#why-use-docker-sandboxes", "context": "", "use_case": "sandboxing AI coding agents", "switched_from": "Apple container framework", "story": "Let's Discuss Sandbox Isolation"}]}