Most devs running coding agents in YOLO mode have no idea what the agent can actually reach. Eric Jia and Kevin Wittek demo getting started with Docker Sandboxes, credential injection, kits, containers vs sandboxes, and a brand new SSH feature:

@Kiview Sandboxing solves the question of where an agent can safely operate. The harder question is what it can safely trust while operating across enterprise systems. Access control needs a trustworthy, traceable knowledge layer behind it. 🤝

@Kiview "I stop every sandbox but port not clean.

@Kiview The SSH feature is the interesting part here — most sandboxed agent setups I've seen still leak through an SSH tunnel someone forgot was open. Would be great to see Docker Sandboxes default to per-session ephemeral keys instead of long-lived credentials.

@Kiview I will check it out

@Kiview The sandbox label can look reassuring while a credential or network path reaches far more than the team intended.

@Kiview Can sandboxed coding agents become standard with visible, revocable credential access?

@Kiview "Bro, looks like Eric Jia's got some Docker goodness cookin' up in that YouTube link!".

@Kiview The permission boundary matters more than the prompt. If the agent can read the host filesystem, env vars and SSH keys, "only edit this repo" is just a request.

The credential injection piece is the part most teams get wrong — giving an agent a full API key vs a scoped, revocable one that only works inside the sandbox is the difference between a contained mistake and a real incident. Curious how the new SSH feature handles session expiry once the sandbox is torn down.

@Kiview Reproducibility starts with controlling the environment, not just scoring the model. What’s the hardest variable to pin down in practice?