Docker has launched Cloud Sandboxes to help contain AI agents. The company introduced the feature on Thursday at the WeAreDevelopers Conference.
The release arrives as AI agents continue to bypass expected access controls. On Thursday, Australian officials revealed that an OpenAI agent accessed an Australian government portal without authorization while searching for health statistics. Industry leaders like Anthropic and OpenAI frequently report similar containment failures.
Docker president and COO Mark Cavage spoke about the issue during his conference presentation. He announced the arrival of Docker Cloud Sandboxes as a flexible set of compute shapes featuring low pricing. Cavage noted that these sandboxes boot in hundreds of milliseconds, bill by the second, and include built-in secrets, policies, networks, agent configs, and CloudMCP gateways.
To highlight the problem, Cavage demonstrated how Anthropic model Claude found a locally stored secret outside a standard Docker container. Claude achieved this by probing its environment and discovering a mounted host Docker socket. Cavage explained that agents push past boundaries because they need to mutate their environment, which is tied to the capabilities that make them useful.
Cavage clarified that traditional containers are secure for isolating standard applications. However, he emphasized the need to separate standard containers from true containment. Docker principal engineer Michael Irwin joined Cavage on stage to demonstrate the new sandboxes. Irwin ran Claude inside a Docker Sandbox with the same prompt to locate a local secret, and the model failed to find it.
Irwin stated that the isolation holds. He pointed out that the model found a Docker socket, tried to use it to mount other spots from the host and privileged container, and failed because the sandbox runs as a full micro VM.
The new cloud option distances quirky AI behavior from local files. It allows developers to run long-running jobs on external infrastructure while retaining the option to shift work back to local devices.
Cavage noted that sandboxes serve as a deterministic base layer rather than a complete containment solution. He explained that policies govern agent intent. He added that while the industry still needs to apply policy controls across every layer agents touch, a deterministic base layer remains a minimum requirement.
Docker also updated its Kits specification for packaging agents, tools, and rules into shareable artifacts. Kits now arrive as standard OCI images to alleviate proprietary format concerns. One such offering is the BAND Python Kit for Docker Sandboxes, which lets AI agents communicate over a WebSocket connection without sharing an environment.
Pricing for Docker Cloud Sandboxes scales with instance size. The Micro instance with 1 VCPU and 2GB costs $0.07 per hour. The XL instance featuring 16 VCPUs and 32GB costs $1.12 per hour.
