Docker's Cloud Sandboxes move coding agents off your laptop

Docker has put the agent sandboxes it launched earlier this year onto its own compute. Cloud Sandboxes arrived on 24 September, and the pitch is about the shape of the work rather than the sandbox itself: an agent that needs five, ten or twenty hours has outgrown the laptop it started on.

What is actually going on

The isolation model has not changed and neither has the command line. Agents still run inside a microVM with its own kernel and its own Docker daemon, so they can work unattended without reaching your files, your network or your keys. What changes is what sits underneath: the machines are always on, and there are as many of them as you ask for. Moving work across is one command, sbx move my-project --to cloud, which captures the sandbox's filesystem and recreates it on the other side. It works in both directions, so you can iterate on code locally and hand the long jobs to a background agent, then pull the result back. Docker says the point of running one product in two places is that how much you can trust an agent should not depend on where it happens to be running.

Each cloud sandbox gets its own secrets and its own network policy, and you can run a hundred of them in parallel without provisioning anything. Starting one does not begin with an install: Docker ships pre-built kits for the leading coding agents, including Claude Code, Codex, Copilot, Antigravity, Open Code and Hermes, and sbx --cloud run codex is enough to launch one. Model Context Protocol servers are connected once and reached through a single gateway shared by every agent, whether the sandbox is in the cloud, on your machine or another client such as the ChatGPT desktop app. Keys and tokens are stored once and injected per request by the sandbox proxy, so an agent never holds the real secret, which is a meaningful answer to prompt injection: an agent cannot leak a key it never had. Network policies set the endpoints an agent may reach, and Docker says centralised governance is coming for enterprises through Docker AI Governance.

What it costs

Cloud Sandboxes are pay-as-you-go and metered by the second, and nothing else. A paused sandbox costs nothing, volumes, egress and the hosting of public images and kits are free, and you can bring your own model key and keep your existing provider for inference. Sizes run from a Micro sandbox with one vCPU and 2GiB of memory at $0.07 an hour through the default Small at 2 vCPU and 4GiB for $0.14, Medium at 4 vCPU and 8GiB for $0.28, Large at 8 vCPU and 16GiB for $0.56, up to an XL with 16 vCPU and 32GiB for $1.12. Sandboxes run for one hour by default and up to 24 hours per session, which means the default size works out at roughly $200 a month if you leave one running around the clock. You need sbx 0.45.1 or later and the pay-as-you-go plan, available on Docker Personal and Pro accounts, and new accounts get $250 in credit for a limited time. Local sandboxes stay free and standalone with no Docker Desktop required, though local and cloud keep separate secrets, templates and network policies.

The standards play

Docker announced a second thing the same day that matters more than it looks. It is taking its Sandbox Kit Spec to the Cloud Native Computing Foundation so that what an agent is allowed to do becomes a neutral, OCI-based artefact rather than a pile of network rules, token scopes and volume mounts kept in shell history and in somebody's memory. Docker's own argument is the container image: it describes how software is built and says nothing about what it may do, which was fine for a web service and is not fine for an agent that installs packages and calls APIs on your behalf.

Our opinion

The interesting decision here is the one Docker did not make. Building cloud sandboxes as a separate product with its own commands would have been easier to sell and easier to meter, and it would have taught developers that a cloud agent is a different kind of thing from a local one. Keeping one isolation model and one command line makes the move boring, and boring is what this needs. The pricing is honest in the same way: $0.07 an hour for a Micro sandbox and per-second metering means trying an agent for twenty minutes costs about two pence, which is the sort of number that changes behaviour. We are less convinced by the enterprise story until Docker AI Governance actually ships, because the network policies that matter to a regulated buyer are the ones sitting in someone else's console. And the CNCF donation deserves watching rather than applause: a permission spec is only a standard once other vendors implement it, and until then it is one company's good idea with a governance logo attached.