Sign In
blue gradieng background round
Docker Sandboxes

Run agents safely, local to cloud.

Run Claude Code, Codex, and your other agents at full speed in MicroVM environments. Local or cloud. One CLI.
Get Started Free Sandbox Kits
Docker Sandboxes

Get started in seconds.

  • $ brew trust docker/tap && brew install docker/tap/sbx
  • > winget install Docker.sbx
  • $ sudo apt-get install docker-sbx
Then sbx run claude or sbx run codex. Read the docs
  • Claude
  • Kiro
  • OpenAI
  • Cursor
  • Devin Desktop
  • Gemini
  • GitHub Copilot
  • Warp
  • Nanoclaw
  • Nous Hermes

One sandbox for every coding agent

Every other sandbox makes you pick a side.

One command. MicroVM-based isolation everywhere.

When a job outgrows your machine, run the same sandbox on Docker-managed infrastructure and carry it back when done.

Burst up

Heavy builds on cloud hardware, not your battery

Keep working

Detach and close the laptop, the agent keeps going

Same isolation

Same microVM boundary on both sides, no downgrade

Carry it over

Sbx move recreates a sandbox’s filesystem on the other side, the work comes with it

Pay only for what you use

Start locally on Docker Sandboxes for free. Cloud compute is metered by the second. Bring your own key for model inference.

Size

vCPUs

GB

Per hour

Micro

1

2 GB

$0.07

Small

2

4 GB

$0.14

Medium

4

8 GB

$0.28

Large

8

16 GB

$0.56

XL

16

32 GB

$1.12
gray
For developers
For platform teams
Run it today

Stop reviewing.
Start shipping.

Hand the agent a task and walk away. It works unattended. Your machine stays untouched.

Packages, services, repos, pull requests

Private Docker Engine in every sandbox

Off the rails? delete it and start fresh

Move a sandbox between laptop and cloud with one command.

Get started free
sbx run claude
Copy
Run it today

Autonomy for devs.
Boundaries for the org.

Developers keep their agents and their speed. You define what every sandbox can reach. Checks: network and filesystem policies enforced at the microVM

One Kit ships a known-good setup to every engineer

Credentials proxied outside the VM

Cloud capacity with the same isolation

Works with the agents your developers already run.

Talk to sales
sbx run claude
Copy
–dangerously-skip-permissions is the default

No permission prompts

The sandbox is the safety, not the prompt. Agents run unattended.

docker compose up, inside the sandbox

Agents can use Docker too

Every sandbox has its own Docker Engine. Build, run, compose. No socket mounting, no host privileges.

sbx rm, done

Disposable by default

Delete it and start fresh in seconds. Nothing to clean up, nothing to roll back.

deny all, allow what you choose

Scoped access

You decide which files, endpoints, and secrets the agent gets, before it runs. The boundary is infrastructure.

Capabilities

No, these aren’t containers.

Really. Sandboxes are microVM environments we built from scratch. Each one gets its own kernel, its own private Docker Engine, and no path back to the host.

Its own kernel

A hardware boundary. A runaway agent hits a boundary, not your machine.

No Docker-in-Docker compromise

Containers alone force elevated privileges the moment an agent builds images. A private engine per microVM does not.

A VMM we built ourselves

Native on macOS, Windows, and Linux. Cold starts fast enough so you have no reason not to sandbox.

gray
Sandbox Kits

The same sandbox, every time.

The same sandbox, every time. One YAML file gives an agent its tools, credentials, network rules, and config. The agent boots ready, the same way, every time.
$ sbx run claude –kit github.com/acme/kits//backend.yaml
Copy

Mixin Kits

Layer additional capabilities onto Claude Code or Codex.

Agent Kits

Define a full agent: its image, its entrypoint, the network it can reach.

Credentials never enter the VM

The real secret stays on your host.

Give a sandbox exactly the tools it needs.

Enable an MCP server for one sandbox and only that sandbox. The agent gets the tools. Nothing else does.
$ sbx mcp ls
$ sbx mcp enable github-official –sandbox my-project
Copy
Governing MCP across an organization is a different job. Docker MCP Enterprise Gateway puts every client behind one endpoint, with identity, policy, and audit on every tool call. See MCP Enterprise Gateway.

Curated catalog ships with the CLI

Scope servers per sandbox, one project gets GitHub, the rest get nothing

Server credentials live in the sbx secret store

Works with whichever agent runs inside.

Everyone else makes you choose.

Real isolation in someone else’s cloud, or your machine with weaker walls. Docker Sandboxes is the only one that runs the same microVM model in both places and moves a sandbox between them.

Docker

E2B

Daytona

Modal

Cloudflare

Isolation on your machine

MicroVM, own kernel

None, cloud only

None, cloud only

None, cloud only

Shared-kernel container for dev parity

Runs in the cloud

Yes, same microVM model

Yes

Yes

Yes

Yes

Move a sandbox between them

One command, sbx move

No

No

No

No

Self-hosting means

Your laptop, today

Your AWS or GCP, via Terraform and Nomad

Your cloud, control plane stays on Daytona’s

Modal-managed infrastructure

Cloudflare’s infrastructure

Docker inside the sandbox

Private engine per sandbox

–

–

–

–

“You don’t trust agents with security. You build walls around them. Docker has been ahead of the curve on exactly this, and Docker Sandboxes is what that looks like at the infrastructure level.”

Gavriel Cohen

Creator of NanoClaw

“Docker Sandboxes let agents have the autonomy to do long-running tasks without compromising safety. We’re excited to integrate Sandboxes into Warp so developers can run agents freely with a consistent environment, whether they’re running locally or in the cloud.”

Ben Navetta

Engineering Lead, Warp

Common questions

What is a sandbox for coding agents?

A disposable, isolated environment where an agent works unattended, with a real dev environment and scoped access to your files, network, and secrets. Your host stays untouched.

How is this different from a container?

A container shares your kernel. A sandbox is a microVM with its own kernel and its own private Docker Engine, so an agent can build and run containers without the elevated privileges Docker-in-Docker requires.

Which agents are supported?

Claude Code, Codex, Cursor, Devin, Copilot CLI, OpenCode, and autonomous systems like NanoClaw. Same isolation, same speed, one sandbox model.

Is YOLO mode actually safe here?

Yes. Permissive modes are the default because the boundary is infrastructure, not the agent’s judgment.

Do I need Docker Desktop?

No. Docker Sandboxes is free and standalone.

What are Sandbox Kits?

Declarative YAML applied at startup. Kits add tools, files, credentials, and network rules to an agent, or define a whole agent, without rebuilding the image.

Can agents use MCP servers inside a sandbox?

Yes. Enable servers from the built-in catalog per sandbox with sbx mcp, with credentials held in the sbx secret store. For MCP governed across an organization, every client, one endpoint, policy and audit on each call, see MCP Enterprise Gateway.

What are Cloud Sandboxes?

The same sandbox on Docker-managed infrastructure, with the same microVM isolation. Detach and the agent keeps working. sbx move carries a sandbox’s filesystem between local and cloud, in either direction.

What if I need org-wide controls?

Docker AI Governance enforces network, filesystem, and MCP policy across every sandbox in the organization, from one console.

Need More Control Over Your Sandboxes?

Your developers get isolated environments to run agents freely and safely. When your team needs to go further, Docker AI Governance adds network access policies, filesystem controls, and org-wide MCP governance: defined once, enforced everywhere.

Talk to us about:

Network access policies for sandbox environments

Filesystem access controls and restrictions

Admin-level configuration for your team

Talk to an expert

Thank you for your interest. The Docker Team will be in touch