Trust Docker for the agents you don’t
Docker launched Cloud Sandboxes, a service allowing developers to run AI agents in isolated microVMs on managed cloud compute. The system supports moving workloads from local laptops to the cloud using the sbx CLI and open Kits. Docker also announced it will submit the Sandbox Kit specification to the Cloud Native Computing Foundation for standardization.
Docker announced Cloud Sandboxes, a service that lets developers start AI‑agent work on a laptop, then shift the same isolated microVM environment to Docker‑managed cloud compute and later retrieve the results, with longer tasks continuing after the laptop is closed. Each sandbox runs in its own microVM with a separate kernel and Docker daemon, allowing agents to install dependencies, build apps and run containers, while developers use the same sbx CLI and reusable “Kits” in both local and cloud settings; credentials and policies are set independently for each location and compute is billed by the second. In the keynote, Docker’s president Mark Cavage said trusted agents need containment, control, choice and capacity, illustrating that a microVM boundary stops an agent from exploiting a host Docker socket that would otherwise expose secrets. The new open Sandbox Kit specification defines an OCI image that bundles an agent, its tools and declared access needs, enabling teams to build, share, scan and pin such packages, with the runtime enforcing policies; Docker published the spec under Apache 2.0 and will submit it to the CNCF for neutral governance.