Docker Sandboxes – Disposable, isolated sandboxes for AI agents

	Docker Sandboxes – Disposable, isolated sandboxes for AI agents(docker.com)
	678 points by etoxin 12 days ago \| 390 comments
	tl;dr: Docker has released Sandboxes (`sbx`), a CLI tool that runs AI coding agents like Claude Code, Copilot CLI, Codex, and OpenCode inside disposable microVMs isolated from the host filesystem and network. The goal is to enable "YOLO mode" (--dangerously-skip-permissions) safely, letting agents install packages, modify configs, and even spin up their own Docker containers without supervision. It's available via Homebrew, winget, and apt, doesn't require Docker Desktop, and offers optional org-wide policy controls through Docker AI Governance.
	HN Discussion: ↑Docker employee clarifies technical architecture, correcting misconceptions about it being containers ↓Skepticism about whether microVMs offer real security benefits over existing VM solutions like Incus/LXD ↓Sandboxing is a duct-tape workaround; proper permission isolation would be a better solution ~Login requirement and lack of Linux focus are frustrating friction points ↓Open-source alternatives (Locki, Gondolin, Tart, Apple Container) already exist and may be superior