Security1 publisher2 min readPublished
Docker moves unattended AI agent runs into microVM sandboxes on its own cloud
Docker's new Cloud Sandboxes run AI agents unattended for hours in microVMs on Docker-hosted compute that scales from 1 to 16 vCPUs. Teams that adopt it move agent secrets and policy enforcement into Docker's cloud, on isolation claims that so far come only from Docker.
The Watch · Security desk
What happened
- Docker launched Cloud Sandboxes at WeAreDevelopers North America to keep AI agent workflows running in its cloud after a developer's laptop shuts down.
- Agents in the cloud service get the same microVM isolation and policies as Docker's local sandboxes, running on infrastructure Docker manages.
- The sandboxes boot in low hundreds of milliseconds with secrets, policy, MCP gateways and agent configuration already built in, according to Docker.
- Kits, Docker's open spec for packaging an agent together with its tools and access rules, are now built as standard OCI images.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure The credentials agents use on unattended jobs now sit in Docker-managed infrastructure, so any lapse on Docker's side reaches customer secrets directly.
- decision Teams that built their own isolated runners for overnight agent jobs now have to decide whether to keep maintaining them or move to a hosted service with no infrastructure of their own.
- precedent With the container company itself saying containers fall short for agents, buyers are likely to judge other agent-hosting services against microVM-level isolation.
Mark Cavage, Docker's president, explained the launch by pointing at the limits of Docker's own core product. "While the containers Docker is known for still have a critical role to play, they weren't designed for the level of isolation AI agents demand," he said [9]. According to Cavage, that is why Docker shipped local sandboxes as a separate product earlier this year and is now extending the same isolation to the cloud [7].
The microVM boundary and the policy layer stop different attacks. The boundary limits what a hijacked agent can reach on the machine underneath it [2]. It does not stop an agent that holds a valid token from using that token against the repository or cloud account it was issued for. On a job that runs unattended for hours [4], no developer is at the machine to see those calls as they happen.
Docker says its policy layer closes that gap [10]. "Docker's sandboxes deliver a secure, model- and harness-neutral environment for running any agentic workload, locally or in the cloud, with policies that the agent can't ignore or change," Mat Velloso, Docker's chief product officer, said [10]. Each sandbox comes with MCP gateways built in [5]. A gateway between the agent and its tools is the obvious place to enforce those policies.
The policies ship inside Kits [11]. Developers write their commands once and run them locally or in the cloud under the same controls [13]. So an agent's permissions travel through the same registries and pull commands as any container image. A team that pulls a shared Kit runs the author's rules unless someone reviews them. A tampered image brings tampered rules to the laptop and to the cloud alike.
Capacity runs from 1 to 16 vCPUs and is fully managed by Docker [6]. Docker pairs the sandboxes with its AI Governance product as a baseline for control over where agents execute [12]. The isolation is a default only for teams already on Docker's tooling. The cloud product uses the same CLI, trust model and Kits as the local one [3].
Every performance figure and security property in the launch comes from Docker and its two executives. Help Net Security's report cites no outside test of the microVM boundary or the policy engine [15].
What to watch
- Independent testing of the Cloud Sandboxes microVM boundary, and of Velloso's claim that agents cannot ignore or change their policies.
- Docker's published terms for how it stores and scopes secrets held for cloud sandboxes, and how it discloses incidents involving them.
- Whether Kits pushed to public registries carry signing or provenance that lets a team verify who wrote an agent's rules.