Docker launched Cloud Sandboxes and an open Sandbox Kit specification at WeAreDevelopers World Congress North America, held September 23-25 in San Jose, giving developers a way to run agent workloads in isolated microVMs on Docker-managed cloud compute. The company also committed to bringing the specification to the Cloud Native Computing Foundation for neutral governance. The move matters because it gives agent tasks a place to run beyond a laptop, with explicit limits on access and a record of what happened.
Each Cloud Sandbox is an isolated microVM with its own kernel and Docker daemon. Agents can install dependencies, build applications, and run containers inside that environment. Developers use sbx, the same command-line tool they use for local sandboxes, and can begin locally, move a sandbox’s filesystem to the cloud for a longer run, and bring it back for review. The same reusable agent packages, called Kits, work in both environments. Local and cloud credentials and policies are configured separately. Cloud Sandboxes are available now, with compute billed by the second.
The Sandbox Kit specification defines an agent environment as an OCI image containing the agent and its tools, plus declarations of the access it needs. Teams can build, push, pull, scan, and pin a Kit by digest using familiar image tooling. The runtime decides which requests to grant and enforces the resulting policy outside the agent. Docker published the specification under Apache 2.0, and Docker Sandboxes is the first runtime to implement it. Nous Research joined Docker President and COO Mark Cavage onstage with Hermes, its open-source agent, as a launch partner.
In his opening keynote, Cavage described four requirements for an agent factory: containment, control, choice, and capacity. He showed an agent running in a container with the host Docker socket mounted reading a secret on the host, not by finding a new vulnerability but by using access the configuration had given it. In a subsequent demonstration, the same attempt to reach the host through the Docker socket failed inside a sandbox. Cavage also said blocking an unapproved network destination differs from recognizing that an otherwise permitted email is going to the wrong customer, and that work remains on whether an action matches the user’s intent.
Docker CTO Tushar Jain’s keynote, “Govern the Runtime, Not the Agent,” argued for a common runtime layer that can govern execution, tools, credentials, permissions, and spend. His demo showed an agent’s request to delete a GitHub repository blocked by a default-deny rule and returned HTTP 403, with enforcement coming from the runtime. In the Q&A, he described team-specific policies that can give a finance user and a developer different access to the same agent, while acknowledging that agent identity remains an open industry challenge. Docker CISO Mark Lechner’s keynote, “One Boundary for the Agentic Era,” showed how a Kit manifest describes an agent’s requested access and how a proxy can use a credential without exposing the raw API key inside the sandbox.
The Docker Pavilion hosted customer and partner sessions across Thursday and Friday. Spectro Cloud showed repeatable agent workloads at the edge; J.P. Morgan Payments brought a two-container payments example that starts with docker compose up; ClickHouse showed what changes when a database starts from a hardened image; and BAND demonstrated separately sandboxed agents exchanging work. Palo Alto Networks connected agent audit records to investigation, Datadog followed a security incident from detection to response, Prediction Guard demonstrated model-call controls alongside execution isolation, and Snyk showed how to inspect work inside a sandbox. GitGuardian, Mend, and Merge covered secrets and runtime guardrails. More than 10,000 developers, AI builders, and technology leaders attended the inaugural event, a year after Docker announced its partnership to bring WeAreDevelopers to North America.
