Project
Docker feature that runs AI coding agents in isolated local or cloud microVM sandboxes, controlled via the sbx CLI, limiting access to the developer's machine.
DeepAgents runs in a four-file Docker Sandbox kit whose agent can reach only a local Model Runner on port 12434, with no cloud keys. The egress policy is careful work, and exact reproduction still rests on what PyPI serves when each sandbox is created.
Reality
Docker published its Sandbox Kit Specification v3 under Apache 2.0, packaging an AI agent's permissions and tools as an ordinary OCI image. Grants that developers now keep in shell history and run flags can be pinned by digest and reviewed like any other image change.
Reality
Docker Cloud Sandboxes let one command move a coding agent's microVM sandbox from laptop to cloud, for runs Docker pitches at up to 21 hours. Where an agent runs becomes a CLI choice, though commenters argue the harder limit is which outside services it can reach.
Reality
Docker released its Sandbox Kit Spec under Apache 2.0 and is taking it to CNCF, with nine named vendors already shipping Kits for their own tools. Enforcement still belongs to the runtime. In the post, that runtime is Docker Sandboxes.
Reality
Docker shipped the fix in Sandboxes 0.42.0 on September 7 and published the advisory on September 15. Every macOS build from 0.28.0 through 0.41.x is affected, and the default mount is the current directory, read-write.
Reality
The open-source kit runs an evaluation command inside a Docker Sandbox and records six fields about what happened, which settles which command produced a number without settling what was installed at the time.
Reality
Docker VMM replaces the per-platform virtualization under Docker Desktop with one in-house backend. It is beta in v4.86 on Windows and macOS; Linux waits for October's general availability.
Reality
Agentic Workflows will start a coding agent inside a microVM with its own Docker daemon, so root-level freedom stops meaning root on the CI runner.
Reality
CVE-2026-22708 let injected text rewrite a Cursor agent's environment, so an approved "git branch" ran something else. It worked with an empty allowlist too.
Reality
Docker's ESP32 walkthrough treats the espressif/idf image as settled ground and spends its energy on sandboxing AI coding agents. The containment boundary now matters more than the toolchain.
Reality