Summary
Sam Witteveen walks through Docker Sandboxes, a product from Docker designed specifically for running AI agents safely without constant human supervision. Unlike standard Docker containers, these sandboxes use microVMs — lightweight virtual machines with their own Linux kernel and hardware-enforced hypervisor isolation — that boot and tear down in seconds while providing stronger security boundaries than software-level containers alone.
The tutorial covers the full setup workflow using the `sbx` CLI: creating sandboxes, configuring granular network access policies (which hosts and ports an agent may reach), setting read/write directory restrictions, and locking down API credentials so an agent cannot exfiltrate secrets even if prompt-injected. Witteveen demonstrates running Claude Code, Codex, and Open Code inside these sandboxes, letting them operate autonomously for hours without risking changes to the host filesystem. The video shows real-time policy edits — toggling individual URLs and ports mid-session — and explains how the balance preset already whitelists common endpoints including OpenAI, Anthropic, AWS, and Google APIs.
A key use case highlighted is rapidly evaluating new open-source agents: spin up a fresh sandbox, let the agent run freely, then discard the entire VM with no side effects. For teams building custom agents with frameworks like Deep Agents or any bespoke orchestration layer, Docker Sandboxes offer a practical path to giving agents genuine autonomy while maintaining precise control over network access, filesystem scope, and credential exposure — without the overhead of managing full virtual machines.
📺 Source: Sam Witteveen · Published August 19, 2026
🏷️ Format: Hands On Build
