Docker launches Sandboxes, microVM isolation for AI agents

Docker has launched Docker Sandboxes, disposable, microVM-isolated environments built for running AI coding agents locally. The product installs with a single command, brew trust docker/tap && brew install docker/tap/sbx, and does not require Docker Desktop.

The core selling point is making so-called YOLO mode safe. YOLO mode, triggered with the flag --dangerously-skip-permissions, lets an AI coding agent act without stopping for approval prompts on each action; Docker's own FAQ calls it essential for speed but risky without guardrails. Sandboxes address that by running each agent inside a dedicated microVM, which Docker describes as a hard security boundary from the host machine, rather than the weaker isolation a plain container provides. Users configure their own network and filesystem controls, and the sandboxes are disposable by default and faster to spin up and tear down than a full VM.

Because each Sandbox is a real microVM rather than a lightweight container, agents running inside one can install packages, run background services, and spin up their own nested Docker containers, working unattended much like a real development environment. Out of the box, Docker supports Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode and Kiro, and says users can also create sandboxes for their own custom agents.

For teams that need the same rules enforced across every developer rather than configured machine by machine, Docker offers a separate product, Docker AI Governance. It adds network access policies, filesystem controls, and organization-wide MCP governance, defined once by an admin and enforced everywhere, and Docker directs teams that want it to talk to its sales team.

Key facts

Docker launched Docker Sandboxes, disposable microVM-isolated environments for running AI coding agents locally, installed via brew trust docker/tap && brew install docker/tap/sbx.
It supports Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode and Kiro out of the box, plus custom agents users create themselves.
The product is built to make YOLO mode (--dangerously-skip-permissions), which skips agent approval prompts for speed, safe by isolating each agent in a dedicated microVM.
Agents inside a Sandbox can install packages, run background services, and spin up their own nested Docker containers, working unattended like a real dev environment while staying disposable and faster to start and stop than a full VM.
A separate product, Docker AI Governance, adds network access policies, filesystem controls and org-wide MCP governance defined once and enforced across a team; Docker Desktop is not required to use Sandboxes.

Why it matters

AI coding agents are increasingly run with approval prompts switched off, in what Docker calls YOLO mode, to remove the friction of confirming every file edit or command. That speed comes at the cost of the safety check that approval prompts provided. Docker Sandboxes targets that gap directly: instead of trusting an agent with the host machine, it gives each agent its own microVM, which Docker positions as a hard security boundary rather than the lighter isolation a container offers. That reframes YOLO mode from an unqualified trust exercise into something scoped and disposable, without giving up the throughput gain that made skipping approvals attractive in the first place.

Who it affects

Developers running autonomous coding agents day to day are the direct audience: Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode and Kiro are supported out of the box, and Docker says custom agents can be added as well. Docker AI Governance is aimed at a second audience, engineering leads and platform teams who need the same network, filesystem and MCP rules applied consistently across every developer's machine rather than set up by hand on each one.

How to use it

Sandboxes install with one command, brew trust docker/tap && brew install docker/tap/sbx, and Docker Desktop is not required. Once installed, an agent runs inside a disposable microVM with network and filesystem controls the user defines. Because a Sandbox is a full microVM rather than a plain container, an agent inside it can install packages, run background services, and even launch its own nested Docker containers, functioning much like a real development machine. Teams that need policy enforced organization-wide rather than per machine add Docker AI Governance, which centralizes network access policies, filesystem rules and MCP governance and enforces them everywhere once defined.

How solid is it

This is a first-party Docker product announcement, not independent testing or a third-party review. Docker's own FAQ states the isolation, installation and supported-agent claims directly, and they read as plain product documentation rather than marketing exaggeration. What the page does not carry is any outside benchmark, any named engineer or spokesperson behind the launch, or a quantified figure for how much faster or lighter a Sandbox actually is than a full VM beyond the unquantified claim of being faster than VMs.

Risks and caveats

The product page gives no pricing for either Sandboxes or Docker AI Governance, no release or launch date, and does not name which operating systems or platforms it runs on. The strength of the isolation also depends on how a user or team actually sets the network and filesystem controls, since those are configurable rather than fixed; Docker markets Sandboxes as what makes YOLO mode safe, but the safety still rests on the boundaries someone chooses to set, not on the sandbox by itself.

“A sandbox is a microVM isolated environment that protects your filesystem and network from agents running inside it.”

— Docker, Sandboxes product FAQ