Docker ships Sandboxes (sbx): microVM isolation for coding agents where YOLO mode is the default, not the risk

Docker·high signalXBlueskyLinkedInCopy link

Docker released `sbx`, a standalone CLI (no Docker Desktop required) that wraps each AI coding agent in a microVM with its own Linux kernel, filesystem, network, and Docker daemon, with out-of-the-box support for Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro. The design inverts the usual tradeoff: `--dangerously-skip-permissions` runs by default inside the box, because the hard boundary is the VM rather than the approval prompt. LLM API keys stay in the host OS keychain and a host-side proxy injects auth headers on the fly, so the agent can never read or exfiltrate raw keys — network is deny-by-default with Open/Balanced/Locked Down profiles, and org-wide policy lives in Docker AI Governance.