Share feedback
Answers are generated based on the documentation.

Cloud sandboxes

Table of contents

Cloud sandboxes run AI agents on Docker-managed infrastructure instead of your local machine. Use them when you need an isolated environment that doesn't depend on the compute resources or virtualization support of your host.

Cloud sandboxes use the same sbx CLI as local sandboxes. Add the global --cloud flag to send a supported command to the Cloud Sandboxes API:

$ sbx --cloud ls

Cloud and local sandboxes have separate state and different capabilities. A cloud sandbox can't mount a host workspace or use host hardware, and its secrets, network policy, ports, and lifecycle are managed in the cloud. See Local and cloud differences before adapting a local workflow.

Prerequisites

To use cloud sandboxes, you need:

To subscribe, open Docker Agentic Platform and sign in. The plan is available for Docker Personal and Docker Pro accounts.

Cloud sandbox compute is metered through the Docker Agentic Platform pay-as-you-go plan. Inference charges aren't included. Your model provider charges for requests made with the API keys or OAuth credentials that you configure.

Get started

Credentials configured for local sandboxes aren't available to cloud sandboxes. Configure a cloud credential for your agent before launching it. For Claude Code, store an Anthropic API key:

$ sbx --cloud secret set anthropic

Cloud sandboxes expire after one hour by default and are deleted when they expire. Copy out work you want to keep before expiration. For other timeout options, see Configure expiration.

Create a sandbox without attaching, allowing access to GitHub for this example:

$ sbx --cloud create --name cloud-project --allow-network github.com:443 claude

Cloud sandboxes don't accept a local workspace path. Clone the public Welcome to Docker repository inside the sandbox:

$ sbx --cloud exec cloud-project git clone \
    https://github.com/docker/welcome-to-docker.git /home/agent/workspace/project

Attach to the agent:

$ sbx --cloud attach cloud-project

Ask Claude to inspect /home/agent/workspace/project and write a description of the application to /home/agent/workspace/review.md. When the file is ready, press Ctrl+\ to detach and leave the agent running.

Copy the result to your machine:

$ sbx --cloud cp cloud-project:/home/agent/workspace/review.md ./review.md

Read the result, then remove the sandbox when you're finished:

$ sbx --cloud rm cloud-project

Removal deletes files stored only in the sandbox. For your own projects, see Transfer files and Authenticate cloud agents before cloning private repositories.

Learn more