What is a sandbox?

An AI agent is a very fast, very eager helper. Ask it to fix a bug and it reads your code, runs commands, installs things, and talks to services on the internet, all on its own.

That eagerness is the point, and it’s also the risk. An agent does what it’s told, and sometimes what it’s told comes from somewhere you didn’t expect: a line hidden in a web page, a comment in someone else’s code. A Docker Sandbox lets the agent keep all of its usefulness while taking away its reach.

Meet your agent. It’s the blue agent below.

Give it a box

Without a sandbox, the agent lives on your computer alongside everything else you have: your photos, your passwords, your other projects. Ask it to do a few things and see what it can reach.

Ask the agent to do four things, first with no sandbox, then inside one:

You ask it to…	With no sandbox	In a sandbox
Fix a bug in my project	It fixes the bug	It fixes the bug. The project is shared
Look at my photos	It looks through your photos	It can’t: your photos aren’t in the box
Find my passwords	It picks up your passwords	It can’t: there’s nothing to find
Free up some disk space	It deletes your documents	It can only tidy up inside the box

A sandbox puts a box around the agent: a small, separate computer of its own (technically, a microVM). The only things from your computer that goes in the box are the things you choose. Nothing more. From the agent’s perspective, the other files and directories simply aren’t there.

That also means the box doesn’t protect your project from the agent. It’s in there on purpose, so the agent can do its job.

One door out, with a guard

An agent that can’t reach the internet can’t do much. It needs to talk to its AI model to think, and to places like GitHub to share its work.

To protect the agent and your work, the sandbox has only one path out. That path has a guard that validates every request against a list of allowed services.

Send some messages from the agent and see what the guard does.

The box has one door, and a guard at it checks a list before anything goes out. Every message is a round trip, and what comes back depends on the list:

AI model and GitHub are on the list, so the message goes out and the answer comes all the way back to the agent.
A new site isn’t on the list, so the guard keeps the door shut. The site never hears from the agent, and the guard hands back a note instead. If the agent really needs it, you can add it to the list.
Sketchy site isn’t on the list either, so the agent gets the same note back, and that’s the guard doing its job.

Only you can change the list. You’re outside the box, and so is the list. The agent is inside.

The guard (technically, a network proxy) works for you, not for the agent. The agent can knock on the door as often as it likes, but it can’t modify the list. Only you can.

The credentials stay with the guard

Plenty of places the agent visits need a credential: a password or a token that proves who you are. Handing the agent your real keys would be risky, because anything it reads could ask it to give them away.

So the agent only ever gets a pretend key. The real ones stay in a secret store on your computer, outside the box, and the guard adds the right one to a message as it leaves.

The agent only ever holds a pretend key. The real keys stay in a secret store on your computer, outside the box. The guard is on your computer too, at the sandbox’s door. Only the internet is beyond it.

When the agent shares its work on GitHub: it sends its message to the door with its own key attached, believing that’s the key GitHub needs. At the door, the guard sees that GitHub is on the list, takes the pretend key off, and puts your real GitHub key from the secret store in its place. GitHub says yes. The agent’s key stays behind with the guard, and your real key never went inside the box.

When the agent is tricked into sharing its key: the guard sees that the sketchy site isn’t on the list and stops the message. And even if it had got out, the key it carried was pretend.

This is the trick that makes people comfortable giving an agent real work (technically, credential injection). The agent can use your accounts without ever holding the keys to them. So there’s nothing valuable for it to leak.

Pack the box with kits

So far the box has held one agent and your project. But, how do you customize the box with a different agent? Different tools? Your own agent skills? Your own network configuration?

That’s where kits come in. Think of kits as the customization layer for the sandbox. A kit is a ready-made bundle you pack into the box: the agent itself, the tools it works with, and notes on how your team does things.

Select kits below to choose an agent and configure the sandbox. Notice how the sandbox is updated, as well as the guard’s allow list and authorized keys.

Kits decide what’s in the box:

The agent comes from a kit too: Claude, Codex, Gemini, or just a plain shell. Each one brings its own AI model to the guard’s allow list, and a key for it.
GitHub tools put GitHub tools on the shelf, add GitHub to the guard’s allow list, and let the guard use your GitHub key.
Go tools put Go tools on the shelf and add the Go module mirror to the list. They need no key.
Your company’s API adds nothing to the shelf. It only adds your company’s service to the list, and a key for it.
Team notes put notes on the shelf for the agent to read, and change nothing else.

The thing to notice: one kit can change all three at once. Packing the GitHub tools put something on the shelf, added a place to the guard’s allow list, and gave the guard a key it may use. A kit is everything the agent needs for one kind of work, including the rules around it.

And a kit never contains your keys, just the fact that a key is needed. You put the real key in your secret store once. That’s why teams can safely share kits with each other.

Check yourself

The agent tries to read your saved passwords. The box stops it: your passwords aren’t inside.
The agent is told to send your GitHub key to a stranger. The door guard stops the message, and the key is pretend anyway.
The agent deletes every file in your project. Nothing stops it. Your project is in the box on purpose. Save your work often.
The agent tries to download from an unknown website. The door guard stops it: the site isn’t on the list.

In short

A Docker Sandbox keeps an AI agent useful and your computer safe with four simple ideas:

The box: the agent gets its own small computer, with only your project inside.
The door guard: the only way out is one door, and the guard follows a list that only you can change.
The pretend key: the agent never holds your real keys. The guard adds them on the way out.
Kits: you choose what’s packed in the box, and each kit can bring its own tools, places, and keys.

Ready for the real thing? Run your first sandbox and see each of these ideas at work.