Skip to content

Commit 63ca4be

Browse files
ndeloofdvdksnclaude
authored
sandboxes: document --clone and consolidate workspace isolation (#25140)
## Summary Alternative to #25007 — written against the post-rename CLI (`--branch[=NAME]` → `--clone`, boolean) from docker/sandboxes#3055. Replaces the entire "Branch mode" documentation with "Clone mode": - `--clone` instead of `--branch=NAME` / `--branch=auto` - No more host-side branch creation: the user/agent decides whether to `git checkout -b ...` inside the sandbox - No more `.sbx/<name>-worktrees/...` directory (clone lives on the container's overlay filesystem) - Clone mode is fixed at create time (no run-time branch switching) - Forge remotes (origin, upstream, …) are propagated from host into the in-container clone so the agent can `git push origin` against the user's fork as on the host Keeps the security framing from #25007: - Source-repository isolation section in `security/isolation.md` (same diagram and guarantees, terminology updated) - "Clone mode" section in `security/workspace.md` calls out that this IS a security boundary, not just a workflow convenience - Five-layer model in `security/_index.md` (adds source-repository) Adds a Cleanup warning in usage.md — `sbx rm` drops in-container commits that haven't been fetched (`git fetch sandbox-<name>`) or pushed; the CLI surfaces a runtime warning before deletion. ## Files changed | File | Change | |------|--------| | `usage.md` | Branch mode → Clone mode (rewrite), drop `.sbx/` worktree section, add propagated remotes, add cleanup warning | | `security/isolation.md` | Add Source-repository isolation section | | `security/workspace.md` | Branch mode stub → Clone mode (boundary) | | `security/_index.md` | 4-layer model → 5-layer (source-repository) | ## Test plan - [ ] Deploy preview renders the updated Git workflow section - [ ] Anchors `#clone-mode` and `#source-repository-isolation` resolve - [ ] `vale` passes (verified locally — zero errors in changed files) - [ ] No remaining `--branch` references on the sandbox pages ## Migration note Callers that scripted `sbx create --branch=feature/x` now pass `--clone` and instruct the agent to create the branch (e.g. via `git checkout -b feature/x`). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: Nicolas De loof <nicolas.deloof@gmail.com> Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1 parent f5b5f2c commit 63ca4be

8 files changed

Lines changed: 317 additions & 184 deletions

File tree

content/manuals/ai/sandboxes/_index.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,8 @@ the [usage guide](usage.md) for common patterns.
7272
extending or tailoring sandboxes
7373
- [Architecture](architecture.md) — microVM isolation, workspace mounting,
7474
networking
75-
- [Security](security/) — isolation model, credential handling, network
76-
policies, workspace trust
75+
- [Security](security/) — isolation model, credential handling, and
76+
network policies
7777
- [CLI reference](/reference/cli/sbx/) — full list of `sbx` commands and options
7878
- [Troubleshooting](troubleshooting.md) — common issues and fixes
7979
- [FAQ](faq.md) — login requirements, telemetry, etc

content/manuals/ai/sandboxes/agents/claude-code.md

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,39 @@ $ sbx run claude -- --dangerously-skip-permissions -c
7272
See the [Claude Code CLI reference](https://code.claude.com/docs/en/cli-reference)
7373
for available options.
7474

75+
## Agents view
76+
77+
Claude Code's [agents view](https://code.claude.com/docs/en/agent-view)
78+
dispatches tasks to subagents that work in parallel, each in its own
79+
Git worktree. Pair it with [clone mode](../usage.md#clone-mode) for an
80+
isolated multi-agent workflow:
81+
82+
```console
83+
$ sbx run --clone claude -- agents
84+
```
85+
86+
This invocation replaces the
87+
[default startup command](#default-startup-command), so it doesn't
88+
include `--dangerously-skip-permissions` and you can't switch to
89+
bypass-permissions mode inside the sandbox. To work around this, either
90+
use Claude Code's auto mode or pass the flag explicitly:
91+
92+
```console
93+
$ sbx run --clone claude -- --dangerously-skip-permissions agents
94+
```
95+
96+
The subagents' worktrees live inside the sandbox's private clone — none
97+
of them touches your host repository. Each subagent commits to its own
98+
branch, and you review the work from the host by fetching the
99+
`sandbox-<sandbox-name>` remote:
100+
101+
```console
102+
$ git fetch sandbox-<sandbox-name>
103+
$ git diff main..sandbox-<sandbox-name>/<branch>
104+
```
105+
106+
See [Git workflow](../usage.md#git-workflow) for clone-mode details.
107+
75108
## Base image
76109

77110
The sandbox uses `docker/sandbox-templates:claude-code`. See

content/manuals/ai/sandboxes/get-started.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -268,5 +268,6 @@ working tree are unaffected.
268268
- [Customize](customize/) — build reusable templates or declare capabilities
269269
with kits
270270
- [Credentials](security/credentials.md) — credential storage and management
271-
- [Workspace trust](security/workspace.md) — review agent changes safely
271+
- [Workspace isolation](security/isolation.md#workspace-isolation) — what
272+
the agent can affect on your host, and how to review changes
272273
- [Policies](security/policy.md) — control outbound access

content/manuals/ai/sandboxes/security/_index.md

Lines changed: 22 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,10 @@ anything on your host except what is explicitly shared.
1818

1919
What crosses the boundary into the VM:
2020

21-
- **Workspace directory:** mounted into the VM with read-write access. With
22-
the default direct mount, changes the agent makes appear on your host
23-
immediately.
21+
- **Workspace directory:** mounted into the VM. The default direct mount is
22+
read-write — the agent edits your working tree in place. With
23+
[`--clone`](../usage.md#clone-mode), your repository is mounted read-only
24+
and the agent works on a private clone.
2425
- **Credentials:** the host-side proxy injects authentication headers into
2526
outbound HTTP requests. The raw credential values never enter the VM.
2627
- **Network access:** HTTP and HTTPS requests to
@@ -41,7 +42,7 @@ and ICMP are blocked at the network layer.
4142

4243
## Isolation layers
4344

44-
The sandbox security model has four layers. See
45+
The sandbox security model has five layers. See
4546
[Isolation layers](isolation/) for technical details on each.
4647

4748
- **Hypervisor isolation:** separate kernel per sandbox. No shared memory or
@@ -50,6 +51,10 @@ The sandbox security model has four layers. See
5051
[Deny-by-default policy](defaults/). Non-HTTP protocols blocked entirely.
5152
- **Docker Engine isolation:** each sandbox has its own Docker Engine with no
5253
path to the host daemon.
54+
- **Workspace isolation** (opt-in via `--clone`): the agent works on a
55+
private in-VM clone and your repository is mounted read-only. The default
56+
direct mode applies no workspace boundary — the agent edits your working
57+
tree in place.
5358
- **Credential isolation:** API keys are injected into HTTP headers by the
5459
host-side proxy. Credential values never enter the VM.
5560

@@ -66,15 +71,17 @@ permitted and what is blocked.
6671
The sandbox isolates the agent from your host system, but the agent's actions
6772
can still affect you through the shared workspace and allowed network channels.
6873

69-
**Workspace changes are live on your host.** The agent edits the same files you
70-
see on your host. This includes files that execute implicitly during normal
71-
development: Git hooks, CI configuration, IDE task configs, `Makefile`,
72-
`package.json` scripts, and similar build files. Review changes before running
73-
any modified code. Note that Git hooks live inside `.git/` and do not appear in
74-
`git diff` output. Check them separately.
75-
See [Workspace trust](workspace/).
76-
77-
**Default allowed domains include broad wildcards.** Some defaults like
74+
In direct mode, workspace changes are live on your host. With the default
75+
direct mount, the agent edits the same files you see on your host. This
76+
includes files that execute implicitly during normal development: Git hooks,
77+
CI configuration, IDE task configs, `Makefile`, `package.json` scripts, and
78+
similar build files. Review changes before running any modified code. Note
79+
that Git hooks live inside `.git/` and do not appear in `git diff` output —
80+
check them separately. See
81+
[Workspace isolation](isolation/#workspace-isolation) for the full list and
82+
for the alternative clone-mode boundary.
83+
84+
The default allowed domains include broad wildcards. Some defaults like
7885
`*.googleapis.com` cover many services beyond AI APIs. Run `sbx policy ls` to
7986
see the full list of active rules, and remove entries you don't need. See
8087
[Default security posture](defaults/).
@@ -93,12 +100,11 @@ See [Organization governance](governance/) for details.
93100

94101
## Learn more
95102

96-
- [Isolation layers](isolation/): how hypervisor, network, Docker, and
97-
credential isolation work
103+
- [Isolation layers](isolation/): how hypervisor, network, Docker,
104+
workspace, and credential isolation work
98105
- [Default security posture](defaults/): what a fresh sandbox permits and
99106
blocks
100107
- [Credentials](credentials/): how to provide and manage API keys
101108
- [Policies](policy/): how to customize network access rules
102109
- [Organization governance](governance/): centrally manage policies across
103110
an organization
104-
- [Workspace trust](workspace/): what to review after an agent session

content/manuals/ai/sandboxes/security/defaults.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ working tree directly, and changes appear on your host immediately.
2828

2929
The agent can read, write, and delete any file within the workspace directory,
3030
including hidden files, configuration files, build scripts, and Git hooks.
31-
See [Workspace trust](workspace.md) for what to review after an agent session.
31+
See [Workspace isolation](isolation.md#workspace-isolation) for what to
32+
review after an agent session.
3233

3334
## Credential defaults
3435

content/manuals/ai/sandboxes/security/isolation.md

Lines changed: 135 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,16 @@
11
---
22
title: Isolation layers
33
weight: 10
4-
description: How Docker Sandboxes isolate AI agents using hypervisor, network, Docker Engine, and credential boundaries.
5-
keywords: docker sandboxes, isolation, hypervisor, network, credentials
4+
description: How Docker Sandboxes isolate AI agents using hypervisor, network, Docker Engine, workspace, and credential boundaries.
5+
keywords: docker sandboxes, isolation, hypervisor, network, credentials, workspace, git
6+
aliases:
7+
- /ai/sandboxes/security/workspace/
68
---
79

810
AI coding agents need to execute code, install packages, and run tools on
9-
your behalf. Docker Sandboxes run each agent in its own microVM with four
10-
isolation layers: hypervisor, network, Docker Engine, and credential proxy.
11+
your behalf. Docker Sandboxes run each agent in its own microVM. Five
12+
isolation layers protect your host: hypervisor, network, Docker Engine,
13+
workspace, and credential proxy.
1114

1215
## Hypervisor isolation
1316

@@ -59,18 +62,136 @@ your host. When the agent runs `docker build` or `docker compose up`, those
5962
commands execute against that engine. The agent has no path to your host Docker
6063
daemon.
6164

62-
```plaintext
63-
Host system
64-
├── Host Docker daemon
65-
│ └── Your containers and images
66-
67-
└── Sandbox Docker engine (isolated from host)
68-
├── [VM] Agent container — sandbox 1
69-
│ └── [VM] Containers created by agent
70-
└── [VM] Agent container — sandbox 2
71-
└── [VM] Containers created by agent
65+
Each sandbox VM runs its own Docker Engine. The agent runs inside the VM,
66+
alongside that engine, and drives it to create containers, all within the
67+
VM:
68+
69+
```mermaid
70+
flowchart TB
71+
subgraph host["Host system"]
72+
subgraph hostd["Host Docker daemon"]
73+
hc["Your containers and images"]
74+
end
75+
subgraph vm["Sandbox (microVM)"]
76+
a["Agent"]
77+
subgraph e["Sandbox Docker engine"]
78+
c["Containers created by agent"]
79+
end
80+
a -->|"docker build / compose up"| e
81+
end
82+
end
83+
style host fill:#3b82f622,stroke:#3b82f6
7284
```
7385

86+
## Workspace isolation
87+
88+
When you create a sandbox, you choose one of two ways to share your
89+
workspace with it:
90+
91+
- **Direct mount** (the default): the agent has read-write access to
92+
your working tree. There is no boundary between the agent's edits and
93+
your host filesystem.
94+
- **Clone mode** (`--clone`): your repository is mounted read-only into
95+
the VM and the agent works on a private clone inside the VM. The
96+
agent's edits never reach your host until you fetch them.
97+
98+
See [Git workflow](../usage.md#git-workflow) for the workflow side of
99+
each.
100+
101+
### Direct mount (default)
102+
103+
By default, your workspace is shared into the VM as a read-write mount.
104+
The agent and the host see the same files, and changes the agent makes
105+
appear on your host as soon as they're written.
106+
107+
There is no isolation between the agent and your workspace in this mode.
108+
The agent can create, modify, or delete any file in the workspace,
109+
including:
110+
111+
- Source code and configuration files
112+
- Build files (`Makefile`, `package.json`, `Cargo.toml`)
113+
- Git hooks (`.git/hooks/`)
114+
- CI configuration (`.github/workflows/`, `.gitlab-ci.yml`)
115+
- IDE configuration (`.vscode/tasks.json`, `.idea/` run configurations)
116+
- Hidden files, shell scripts, and executables
117+
118+
Some of these files execute code when you trigger normal development
119+
actions — committing, pushing, building, or opening the project in an IDE.
120+
Review them after any agent session before performing those actions:
121+
122+
- Git hooks (`.git/hooks/`) run on commit, push, and other Git actions.
123+
These are inside `.git/` and don't appear in `git diff` output —
124+
check them separately with `ls -la .git/hooks/`.
125+
- CI configuration (`.github/workflows/`, `.gitlab-ci.yml`) runs on
126+
push.
127+
- Build files (`Makefile`, `package.json` scripts, `Cargo.toml`) run
128+
during build or install steps.
129+
- IDE configuration (`.vscode/tasks.json`, `.idea/`) can run tasks
130+
when you open the project.
131+
132+
> [!WARNING]
133+
> Treat sandbox-modified workspace files the same way you would treat a pull
134+
> request from an untrusted contributor: review before you trust them on
135+
> your host.
136+
137+
### Clone mode
138+
139+
When you start a sandbox with [`--clone`](../usage.md#clone-mode), the agent
140+
never works directly against your host repository. Even with full root
141+
inside the VM, it cannot modify your `.git` directory, your working tree,
142+
or any tracked file on your host.
143+
144+
```mermaid
145+
flowchart LR
146+
subgraph host["Host repository (untouched)"]
147+
direction TB
148+
repo[".git/ + working tree"]
149+
remote["remote sandbox-&lt;name&gt;"]
150+
end
151+
subgraph vm["Sandbox VM"]
152+
direction TB
153+
mount["/run/sandbox/source<br/>(read-only bind mount)"]
154+
clone["private clone (RW)<br/>agent edits here"]
155+
daemon["git-daemon"]
156+
end
157+
repo -->|"read-only bind mount"| mount
158+
mount -->|"git clone"| clone
159+
clone --> daemon
160+
daemon -->|"git fetch"| remote
161+
```
162+
163+
How the boundary is enforced:
164+
165+
- Your repository's Git root is mounted at `/run/sandbox/source` as
166+
read-only. Nothing the agent does inside the VM can write back through
167+
that mount.
168+
- The agent works on a private clone that lives inside the sandbox. The
169+
clone has its own index, its own refs, and its own working tree. Writes
170+
to the clone never reach your host.
171+
- The sandbox publishes the clone over a Git daemon bound to localhost on
172+
the host. The CLI wires it up as a `sandbox-<sandbox-name>` Git remote on
173+
your host repository. Fetching from that remote uses the same trust
174+
model as fetching from any third-party remote — nothing is integrated
175+
until you explicitly merge or check out the fetched refs.
176+
177+
The practical guarantees:
178+
179+
- The agent cannot modify any tracked file or any byte under `.git/` on
180+
your host. A compromised or buggy agent cannot drop a
181+
`.git/hooks/pre-commit`, alter `.github/workflows/`, or sneak changes
182+
into your working tree.
183+
- Concurrent `git` commands on the host and inside the sandbox cannot
184+
race on a shared `.git/index` or shared refs — there is no shared
185+
writable state.
186+
- Credentials, signing keys, and any settings in your repository's
187+
`.git/config` stay on the host. The agent's clone has its own
188+
independent configuration.
189+
190+
Use clone mode whenever you want a strong boundary between the agent's
191+
Git activity and your host repository — for example when running an
192+
unfamiliar agent, running multiple agents on the same repository at once,
193+
or keeping your working tree clean while the agent works.
194+
74195
## Credential isolation
75196

76197
Most agents need API keys for their model provider. Rather than passing keys

content/manuals/ai/sandboxes/security/workspace.md

Lines changed: 0 additions & 72 deletions
This file was deleted.

0 commit comments

Comments
 (0)