# Docker Sandboxes

Docker's microVM sandboxes for running AI coding agents isolated from your host

**Verdict: conditional.** Docker Sandboxes is a free way to let coding agents such as Claude Code, Codex or Gemini run with full sudo inside a microVM with its own kernel, Docker Engine, deny-by-default networking and proxy-injected credentials. Conditional on patching and mount discipline: releases from 0.28.0 until the 0.42.0 fix carry a critical macOS host-file escape, and the default mount is read-write, so the agent edits your working tree in place. Right for developers running agents unattended. Last verified 2026-10-15.

Docker Sandboxes runs AI coding agents in isolated microVMs through the free `sbx` CLI. Each sandbox gets its own kernel, its own Docker Engine, its own filesystem and its own network, so an agent can have full sudo, build containers and install packages without reaching the host beyond what is shared. Docker lists eleven supported agents: Claude Code, Codex, Copilot, Cursor, Devin, Docker Agent, Droid, Gemini, Kiro, OpenCode and an agent-less Shell. Outbound traffic goes through a host proxy under a deny-by-default policy whose defaults include broad wildcards, and the proxy injects authentication headers so raw credentials never enter the VM. The workspace can be mounted read-write (the default when run from a project directory), cloned from a read-only mount with `--clone`, or not shared at all. Local MCP servers run on the host with host permissions. It runs on macOS 14 or later on Apple silicon, Windows 11 with the Windows Hypervisor Platform, and Ubuntu 24.04 or later with KVM, without Docker Desktop or Docker Engine, and requires signing in to a Docker account. The CLI is free, including for commercial work; centralized network, filesystem and MCP policies for organizations need a separate paid subscription. Version 0.42.0 (September 7, 2026) fixed CVE-2026-77179, a critical macOS escape from the shared workspace to arbitrary host files, and CVE-2026-79994, a high-severity Unix socket relay escape.

## Strengths

- Giving an agent full sudo and its own Docker Engine without exposing the host kernel
- Keeping API keys out of the agent: the host proxy injects auth headers and raw credentials never enter the VM
- Reviewing agent work before it touches your tree: `--clone` mounts the repo read-only and the agent works on a private clone
- Running many agents one way: eleven are supported, including Claude Code, Codex, Copilot, Cursor, Devin, Gemini and OpenCode
- Unpatched installs: versions 0.28.0 to before 0.42.0 on macOS let guest code read or modify arbitrary host files
- Protecting the working tree under the default mount: changes to Git hooks and build scripts reach the host immediately
- Isolating local MCP servers, which run on the host with host permissions
- Intel Macs, Windows 10 or Windows on Arm, or Ubuntu before 24.04: it needs Apple silicon on macOS 14+, Windows 11 on a 64-bit Intel or AMD processor, or Ubuntu 24.04+ with KVM

## Pricing

- Model: freemium
- sbx CLI: $0
- Cloud sandboxes: Pay-as-you-go
- Organization governance: Not published

Website: https://docs.docker.com/ai/sandboxes/

## Sources

- [Docker security announcements (CVE-2026-77179 and CVE-2026-79994)](https://docs.docker.com/security/security-announcements/)
- [Docker Docs: Docker Sandboxes overview](https://docs.docker.com/ai/sandboxes/)
- [Docker Docs: Docker Sandboxes security model](https://docs.docker.com/ai/sandboxes/security/)
- [Docker Docs: Install Docker Sandboxes](https://docs.docker.com/ai/sandboxes/install/)
- [Docker Docs: Docker Sandboxes supported agents](https://docs.docker.com/ai/sandboxes/agents/)
- [Docker Docs: Docker Sandboxes get started](https://docs.docker.com/ai/sandboxes/get-started/)
- [Docker Sandboxes release notes (v0.48.0 on 2026-10-13)](https://docs.docker.com/ai/sandboxes/release-notes/)
- [The Hacker News: Critical Docker Sandboxes flaw (Sep 17, 2026)](https://thehackernews.com/2026/09/critical-docker-sandboxes-flaw-lets.html)

Canonical: https://neomanex.com/directory/docker-sandboxes