@@ -10,98 +10,61 @@ params:
1010 text : Experimental
1111---
1212
13- {{< summary-bar feature_name="Docker Sandboxes" >}}
13+ {{< summary-bar feature_name="Docker Sandboxes sbx " >}}
1414
15- Docker Sandboxes lets you run AI coding agents in isolated environments on your
16- machine. Sandboxes provides a secure way to give agents autonomy without
17- compromising your system.
15+ Docker Sandboxes run AI coding agents in isolated microVM sandboxes. Each
16+ sandbox gets its own Docker daemon, filesystem, and network — the agent can
17+ build containers, install packages, and modify files without touching your host
18+ system.
1819
19- ## Why use Docker Sandboxes
20-
21- AI agents need to execute commands, install packages, and test code. Running
22- them directly on your host machine means they have full access to your files,
23- processes, and network. Docker Sandboxes isolates agents in microVMs, each with
24- its own Docker daemon. Agents can spin up test containers and modify their
25- environment without affecting your host.
26-
27- You get:
28-
29- - Agent autonomy without host system risk
30- - YOLO mode by default - agents work without asking permission
31- - Private Docker daemon for running test containers
32- - File sharing between host and sandbox
33- - Network access control
34-
35- For a comparison between Docker Sandboxes and other approaches to isolating
36- coding agents, see [ Comparison to alternatives] ( ./architecture.md#comparison-to-alternatives ) .
37-
38- > [ !NOTE]
39- > MicroVM-based sandboxes require macOS or Windows (experimental). Linux users
40- > can use legacy container-based sandboxes with
41- > [ Docker Desktop 4.57] ( /desktop/release-notes/#4570 ) .
20+ ## Get started
4221
43- ## How to use sandboxes
22+ Install the ` sbx ` CLI and sign in:
4423
45- To create and run a sandbox:
24+ {{< tabs >}}
25+ {{< tab name="macOS" >}}
4626
4727``` console
48- $ cd ~ /my-project
49- $ docker sandbox run claude
28+ $ brew install docker/tap/sbx
29+ $ sbx login
5030```
5131
52- Replace ` claude ` with your [ preferred agent] ( ./agents/_index.md ) . This command
53- creates a sandbox for your workspace (` ~/my-project ` ) and starts the agent. The
54- agent can now work with your code, install tools, and run containers inside the
55- isolated sandbox.
56-
57- ## How it works
58-
59- Sandboxes run in lightweight microVMs with private Docker daemons. Each sandbox
60- is completely isolated - the agent runs inside the VM and can't access your
61- host Docker daemon, containers, or files outside the workspace.
32+ {{< /tab >}}
33+ {{< tab name="Windows" >}}
6234
63- Your workspace directory syncs between host and sandbox at the same absolute
64- path, so file paths in error messages match between environments.
65-
66- Sandboxes don't appear in ` docker ps ` on your host because they're VMs, not
67- containers. Use ` docker sandbox ls ` to see them.
68-
69- For technical details on the architecture, isolation model, and networking, see
70- [ Architecture] ( architecture.md ) .
35+ ``` powershell
36+ > winget install -h Docker.sbx
37+ > sbx login
38+ ```
7139
72- ### Multiple sandboxes
40+ {{< /tab >}}
41+ {{< /tabs >}}
7342
74- Create separate sandboxes for different projects :
43+ Then launch an agent in a sandbox :
7544
7645``` console
77- $ docker sandbox run claude ~ /project-a
78- $ docker sandbox run claude ~ /project-b
46+ $ cd ~ /my-project
47+ $ sbx run claude
7948```
8049
81- Each sandbox is completely isolated from the others. Sandboxes persist until
82- you remove them, so installed packages and configuration stay available for
83- that workspace.
84-
85- ## Supported agents
50+ See the [ get started guide] ( get-started.md ) for a full walkthrough, or jump to
51+ the [ usage guide] ( usage.md ) for common patterns.
8652
87- Docker Sandboxes works with multiple AI coding agents:
88-
89- - ** Claude Code** - Anthropic's coding agent (production-ready)
90- - ** Codex** - OpenAI's Codex agent (in development)
91- - ** Copilot** - GitHub Copilot agent (in development)
92- - ** Gemini** - Google's Gemini agent (in development)
93- - ** OpenCode** - Multi-provider agent with TUI interface (in development)
94- - ** [ Docker Agent] ( /ai/docker-agent/ ) ** - Docker's multi-provider coding agent (in development)
95- - ** Kiro** - Interactive agent with device flow auth (in development)
96- - ** Shell** - Minimal sandbox for manual agent installation
97-
98- For detailed configuration instructions, see [ Supported agents] ( agents/ ) .
99-
100- ## Get started
53+ ## Learn more
10154
102- Head to the [ Get started guide] ( get-started.md ) to run your first sandboxed agent.
55+ - [ Agents] ( agents/ ) — supported agents and per-agent configuration
56+ - [ Custom environments] ( agents/custom-environments.md ) — build reusable sandbox
57+ images with pre-installed tools
58+ - [ Architecture] ( architecture.md ) — microVM isolation, workspace mounting,
59+ networking
60+ - [ Security] ( security/ ) — isolation model, credential handling, network
61+ policies, workspace trust
62+ - [ CLI reference] ( /reference/cli/sbx/ ) — full list of ` sbx ` commands and options
63+ - [ Troubleshooting] ( troubleshooting.md ) — common issues and fixes
64+ - [ FAQ] ( faq.md ) — login requirements, telemetry, etc
10365
104- ## Troubleshooting
66+ ## Docker Desktop integration
10567
106- See [ Troubleshooting] ( ./troubleshooting ) for common configuration errors, or
107- report issues on the [ Docker Desktop issue tracker] ( https://github.com/docker/desktop-feedback ) .
68+ Docker Desktop also includes a [ built-in sandbox command] ( docker-desktop.md )
69+ (` docker sandbox ` ) with a subset of features. The ` sbx ` CLI is recommended for
70+ most use cases.
0 commit comments