Docker Sandboxes Changed the Trust Boundary for AI Coding Agents

A coding agent with extensive permissions—shell access, package management, Docker daemon control, credentials, and network capabilities—is a far more significant risk than a simple code suggestion agent. The critical security consideration is not merely whether the agent operates within a container, but which resources are exposed, in which direction, and with what level of authority.

Docker Sandboxes address this concern by creating a microVM environment for the agent, providing the agent with full control inside the VM while restricting host access through specific boundaries.

These boundaries include the workspace, network, credentials, MCP (Microservice Control Plane) servers, and shared skills. By operating within a sandbox, the agent's actions are confined within these controlled environments. The three primary file boundaries are direct mount sharing, clone mode with a private in-VM clone, and sandbox filesystem-only. The sandbox mode chosen should align with the task at hand, not relying on developer habits.

One significant advantage of Docker Sandboxes is the separation of Docker Engine, preventing the host Docker socket from being exposed to the sandbox. While credentials can still be injected through a host-side proxy, the exposure of raw credential values is minimized. Network traffic is governed by outbound TCP traffic passing through a host proxy and a deny-by-default policy, ensuring that only necessary services are accessible.

Shared skills represent an exception, as they allow communication between sandboxes but should be treated as part of the same trust boundary.

Threat modeling should be applied to each capability, identifying the resource, direction, authority, and required review before use. For example, workspace access is limited to private clone use, network access is restricted to registry and model APIs, and MCP servers operate with read-only access to the issue tracker. This structured approach ensures that every capability is explicitly defined, reducing ambiguity in the security model.

Before running an autonomous coding task, it is recommended to use clone or mountless mode, restrict network access to necessary services, provide task-specific credentials, review any local MCP servers, and disable shared skills when unnecessary. Additionally, all modifications to hooks, scripts, or CI files should be reviewed before execution.

Understanding that isolation controls where code executes, rather than determining the appropriateness of proposed actions, is crucial. Docker Sandboxes provide a robust environment to enhance the security of coding agents, but the final decision rests on carefully managed shared resources.