Docker's new sandboxes aim to contain AI agents for real

In a market where AI agents keep breaking the rules and escaping their containers, Docker has a new solution. On Thursday, the company debuted Cloud Sandboxes in a bid to keep AI agents within boundaries. Despite the existence and implementation of sandboxing technology as a way to limit the reach of AI agents, industry leaders like Anthropic and OpenAI keep reporting containment failures. On Thursday, Australian officials disclosed that an OpenAI agent had accessed an Australian government portal without authorization while seeking health statistics. It's the latest in a series of incidents involving AI agents pushing beyond access controls their operators expected them to respect. On the heels of Docker Sandboxes, the container biz is now offering a hosted option, which puts a bit more distance between squirrely AI and precious locally stored files. "We're announcing today Docker Cloud Sandboxes, which is a simple, flexible set of compute shapes with simple low, low pricing," said Docker president and COO Mark Cavage at the WeAreDevelopers Conference. "We have cloud sandboxes that boot in hundreds of milliseconds. They're billed by the second, and they have secrets, policies, networks, agent config, CloudMCP gateways, all built in." With a nod to the elephant in the room - the ability of AI agents to bypass barriers - Cavage demonstrated how Anthropic's Claude model, despite being started in a Docker container, can find a locally stored secret outside the container by probing its environment and finding a hole - the mounted host Docker socket. "Agents are going to find the edges of your environment because they need to mutate your environment," he said, adding that the capabilities that make agents useful and powerful are the ones that allow them to push past boundaries. It's not that containers are insecure, said Cavage. They're doing the job they were designed to do, to isolate applications. "We have to separate containers from containment," he said. Cavage invited Docker principal engineer Michael Irwin on stage to demonstrate sandbox-based containment. Launching Claude in a Docker Sandbox, Irwin gave the model the same prompt to find a local secret, and this time the AI model could not do so. "The isolation holds," said Irwin. "And in fact, if we look at the summary that's in the output here, we can see that it's found a Docker socket, it tried to utilize it to mount other spots from the host and privileged container and it just couldn't get there. And that's because the sandbox is running as a full micro VM." That's the case for sandboxes and it now extends to the cloud, giving developers the option to process long-running jobs on external infrastructure. This removes the need to access a local machine but still provides the option to shift work back to a local device if needed. "Sandboxes are part of the containment story, but not all of it," said Cavage. "They're the deterministic base layer, while policies are what govern the agent's intent. As an industry, we still have work to do applying policy and intent controls across every layer of the stack agents touch, but having that deterministic base layer in place should be the absolute minimum requirement." Docker has also updated its Kits specification for packaging agents, tools, and rules into a shareable artifact. Kits now come as standard OCI images, which may address concerns about being locked into a proprietary format. One such Kit comes from BAND, which makes enterprise infrastructure for distributed AI agent deployments. The BAND Python Kit for Docker Sandboxes provides a way for AI agents to work with one another over a WebSocket connection without operating in the same environment. The idea is to give developers more control and tools to observe what agents are doing within defined boundaries. Pricing for Docker Cloud Sandboxes varies with instance size, starting with Micro (1 VCPU, 2GB) for $0.07 per hour, and extending to XL (16 VCPUs, 32 GB) for $1.12 per hour. (R)