Docker Cloud Sandboxes Provide a Consistent Sandbox Abstraction Across Laptop and Cloud

Docker Cloud Sandboxes Provide a Consistent Sandbox Abstraction Across Laptop and Cloud - InfoQ

InfoQ Homepage News Docker Cloud Sandboxes Provide a Consistent Sandbox Abstraction Across Laptop and Cloud

DevOps

InfoQ Certified AI-Assisted Engineering Program (online, Oct 19): Build the harness that holds.

Docker Cloud Sandboxes Provide a Consistent Sandbox Abstraction Across Laptop and Cloud

Sep 26, 2026 2 min read

by

• Sergio De Simone

#### Follow us on

Youtube

232K Followers

Linkedin

26K Followers

Instagram

New

RSS

19K Readers

X

57.1k Followers

Facebook

21K Likes

Bluesky

Listen to this article -

0:00

Audio ready to play

Your browser does not support the audio element.

Normal

1.25x

1.5x

Like

new dropdown rading list

• Reading list

Docker Cloud Sandboxes provide secure, hosted execution environments for running AI coding agents on Docker-managed infrastructure. Built on hardware-enforced microVM isolation, the platform provides a consistent execution environment and unified CLI workflows for seamlessly moving workloads from local machines to the cloud.

Docker Cloud Sandboxes are an evolution of Docker Sandboxes , which Docker introduced earlier this year to provide local microVM environments where coding agents could operate autonomously and safely. However, developers are increasingly running multiple long-horizon tasks in parallel, says Docker, creating a need for persistent, scalable execution environments beyond the local machine.

When agents worked in short bursts, the question was whether the model could hold a task together. Now that they work in hours, the question is where those hours happen. A laptop is built around a person. It sleeps when the lid closes, slows down on battery, and disconnects when you move.

With Cloud Sandboxes developers can move a sandbox between local and cloud execution with one command, making it possible to "run a dozen agents at once, for five, ten, or 21 hours each, without watching any of them". Cloud Sandboxes use the same isolation model as local Docker Sandboxes and are managed through the same CLI. This enables developers to start a task locally and then move it to the cloud when it requires additional resource, or hand off a task to the cloud before leaving for the day. Another key use case is parallelizing workloads across dozens of tasks, with each task running in its own isolated cloud sandbox.

To move a sandbox from your local machine to Docker infrastructure or vice versa, you run:

$ sbx move my-project --to cloud

This command "captures the sandbox's filesystem and recreates it on the other side, so your work carries over".

Alongside Cloud Sandboxes, Docker is also releasing several kits, which are pre-configured, pre-built sandboxes defined according to the Docker Sandbox Kit Specification . In the latest Kits v3 specification, Kits are no longer treated as a separate artifact but are instead packaged as standard OCI images. This allows them to be used just like any other Docker image, including with build and pull , and to serve as a base for building more complex Kits.

Commenting on the announcement, Deutsche Bank lead devops engineer Florin Lungu said he finds "it interesting that this innovation allows for safe, autonomous coding in microVM environments , enhancing flexibility in our workflows".

However, Reddit user CircumspectCapybara pointed out that sandboxing addresses only part of the issue : "any remotely useful agent workload is going to need to connect their sandboxed agents to limited external services" to access "tools it would realistically call in real life, real libraries or artifacts and stuff it might try to pull down from PyPI or Docker Hub or Hugging Face". This creates a potential attack surface even when the agent remains contained within the sandbox: "they can just talk to the narrow set of services they have been given access to and by talking to them break them while remaining inside the sandbox".

As a final note, Hacker News reader ongedierte echoed this concern arguing that "traditional sandboxes are not going to be the correct abstraction" and that "building harnesses based on object capabilities and being able to limit exactly what an agent can access in what manner will be the way forward".

main wrapper for authors section

About the Author

section title

main wrapper for each author

#### Sergio De Simone

Show more

Show less

#### This content is in the DevOps topic

##### Related Topics:

• Development

• DevOps

• AI, ML & Data Engineering

• Cloud

• AI Security

• Containers

• Agents

• Docker

• Related Editorial

• Related Sponsors

• Related Sponsor October 8, 2026, 12 PM EDT When AI Accelerates Development, Can Your CI Pipeline Keep Up? Presented by: Eric Metaj - Product Marketing Manager, Software Delivery at Datadog, and Rohin Chandra - Product Manager, CI/CD Optimization at Datadog

The InfoQ Newsletter

A round-up of last week’s content on InfoQ sent out every Tuesday. Join a community of over 250,000 senior developers. View an example

We protect your privacy.