Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-10 · high
It's a standalone CLI, no Docker Desktop needed, and keys stay in the host keychain, never visible to the agent.
Why now: As of Aug. 10, Docker's skip-permissions default in Sandboxes is live at launch, not a later bolt-on.
Docker shipped Sandboxes, a standalone CLI that isolates each coding agent inside a microVM with a separate kernel, filesystem, network, and Docker daemon, per the product page for Sandboxes.
That's why Docker runs --dangerously-skip-permissions, known as YOLO mode, by default inside the box. Developers who've avoided full-autonomy agent modes because one bad command could wreck their host machine now get a boundary that survives the mistake.
No Docker Desktop install is required, since Sandboxes ships as its own CLI. It works out of the box with six agents: Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro.
API keys never reach the agent itself. They stay in the host keychain, and a host-side proxy injects the auth headers, so a compromised or careless agent inside the sandbox can't read raw credentials. That protection applies across all six supported agents.
Networking is deny-by-default across three profiles, so an agent can't reach the open internet unless a profile explicitly allows it.
Permission prompts were never the safeguard that mattered. Developer attention doesn't scale to an agent running unattended, and Docker's real move is shifting the trust boundary to something that does. Whether other agent CLIs move to VM-level isolation instead of leaning on prompts alone is the next thing worth watching.
Each link below shares sources, entities, or timing with this story.
Codex competes with Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Codex competes with Claude Code); both cover Claude Code, CLI, Codex, Gemini CLI; overlapping topics (agent, claude, code, codex, keys).
Linked by a graph relationship (Codex competes with Claude Code); both cover Claude Code, CLI, Codex, Gemini CLI; overlapping topics (agent, claude, code, codex, coding).
OpenCode competes with Codex / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OpenCode competes with Codex); both cover Claude Code, CLI, Codex, OpenCode; overlapping topics (agent, answer, claude, code, codex).
Codex competes with Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Codex competes with Claude Code); both cover Claude Code, Codex, Copilot CLI, Gemini CLI; overlapping topics (agent, claude, code, codex).
AionUi uses Gemini CLI / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (AionUi uses Gemini CLI); both cover Claude Code, CLI, Codex, Gemini CLI; overlapping topics (agent, claude, code, codex).
Linked by a graph relationship (AionUi uses Gemini CLI); both cover Claude Code, CLI, Codex, Gemini CLI; overlapping topics (agent, claude, code, codex).
Codex competes with Claude Code / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Codex competes with Claude Code); both cover Claude Code, Codex, Docker Sandboxes; reported by the same outlet (docker.com).
Codex competes with Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Codex competes with Claude Code); both cover Claude Code, Codex, Copilot CLI, OpenCode; overlapping topics (agent, claude, code, codex, coding).