Docker Sandbox kit confines a DeepAgents agent to one local model port

The sandbox layer is Docker's sbx CLI. It runs agents in isolated microVM-style environments with a credential proxy and an enforced network policy ^[4]. A kit is one OCI image whose manifest carries a descriptor listing what the kit offers, what it needs from the host as typed capability requests, and what it needs from other kits ^[5]. Inside, the harness gives the agent a planning tool, a virtual filesystem, sub-agent delegation and a detailed system prompt ^[1].

The network policy is the part I would copy. Here is the capability as the post gives it ^[7]:

```yaml capabilities: - type: com.docker.sandbox/network-policy@1 config: install: allow: [pypi.org, files.pythonhosted.org] runtime: allow: [host.docker.internal:12434] ```

Each phase gets its own allow list, and a phase with no entry gets no egress ^[7]. The PyPI grant closes before the agent starts ^[7]. Model Runner speaks the OpenAI wire format, so deepagents talks to it through a standard ChatOpenAI client ^[8]. The kit still pre-wires an OPENAI_API_KEY ^[9], for an agent whose traffic, according to the post, never leaves the machine ^[8].

The install design follows from the mixin model. A mixin's overlay lands on a base it has never seen ^[6]. The base's Python version and site-packages path are unknown in advance, so a prebuilt package tree copied into the image would not resolve ^[10]. The kit instead installs deepagents and langchain-openai with pip into the composed base's Python at sandbox create time ^[9][10]. Lifecycle hooks fail early if that Python is older than 3.11. After installing, they re-read the installed version and fail on a mismatch ^[11]. "A pinned version claim is only honest if the build enforces it," the post's author wrote ^[12].

I think this is the right call for a mixin. A baked layer would break on an unknown base, and a verified create-time install is what remains ^[10][11].

Reproducibility is where the claim gets thinner. Every create resolves packages against PyPI as it stands that day ^[1]. The post describes the version check on the installed package; the descriptor excerpt does not show a lock on langchain-openai or the packages beneath it ^[11]. The interpreter varies too. Any base at 3.11 or newer passes the gate, so two compositions can run the same deepagents release on different Pythons ^[3]. For an environment to transfer exactly between machines, both the dependency tree and the interpreter would have to be fixed ^[1].

The security half holds up better. The post starts from the premise that an agent with a filesystem, a shell and a network has the same reach as the laptop it runs on ^[14]. The sandbox keeps the shell and filesystem inside the isolated environment and cuts runtime egress to one host port ^[4][7]. That leaves the Model Runner API on the host as the one network service a running agent can reach ^[2].

Adoption needs three things. The base workload must carry Python 3.11 or newer, such as the stock docker/sbx-kit-shell image ^[6][11]. The host must run Docker Model Runner ^[3]. The install phase needs PyPI ^[7].