Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

Today's sandbox protects the agent. Tomorrow's may need to protect the code it writes. Oleg Šelajev 🇪🇪🧊🐳 talks with Docker Sandboxes PM Eric Jia about where sandboxing is headed and what developers should be preparing for next.

Docker

557,605 subscribers

12,161 views • 3 months ago •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

2 Comments

Jason Fleagle3 months ago

@shelajev Protecting generated code means treating output as an untrusted artifact. Build it without ambient credentials, scan dependencies and secrets, run tests in a disposable environment, compare declared versus observed behavior, and require a signed acceptance step before merge.

RH Fardin3 months ago

@shelajev Protecting the agent isn't enough if its output can quietly poison the codebase. Sandboxing generated code will become table stakes.

Related Videos

Most devs running coding agents in YOLO mode have no idea what the agent can actually reach. Eric Jia and Kevin Wittek demo getting started with Docker Sandboxes, credential injection, kits, containers vs sandboxes, and a brand new SSH feature:

Docker

20,530 views • 2 months ago

Curious about Docker Sandboxes but not sure where to start? Reynald Adolphe walks through the complete setup using NanoClaw - covering Sandbox creation, Claude Code, secure credentials, and the isolation model behind safer agents. Watch →

Curious about Docker Sandboxes but not sure where to start? Reynald Adolphe walks through the complete setup using NanoClaw - covering Sandbox creation, Claude Code, secure credentials, and the isolation model behind safer agents. Watch →

Docker

12,631 views • 3 months ago

Your coding agent runs as you. It has your credentials, your filesystem, your network. Docker Sandboxes change that. The setup that works on one dev's machine should work on everyone's. Eric Jia and Kevin Wittek on how kits make that possible:

Your coding agent runs as you. It has your credentials, your filesystem, your network. Docker Sandboxes change that. The setup that works on one dev's machine should work on everyone's. Eric Jia and Kevin Wittek on how kits make that possible:

Docker

17,402 views • 1 month ago

Docker is excited to partner with E2B, a platform for running AI-generated code in secure cloud sandboxes. Docker + E2B now gives AI agents access to real tools (GitHub, Perplexity, Browserbase) in secure sandboxes via the MCP Catalog.

Docker is excited to partner with E2B, a platform for running AI-generated code in secure cloud sandboxes. Docker + E2B now gives AI agents access to real tools (GitHub, Perplexity, Browserbase) in secure sandboxes via the MCP Catalog.

Docker

45,609 views • 1 year ago

At WeAreDevelopers, Docker CISO Mark Lechner highlighted how most orgs have no visibility into what their agents can reach. His take: manage manifests as code, only run agents in observable environments. Cloud Sandboxes is the boundary that stays with your agent, even after you close your laptop. Try it yourself - for the next 3 days, new accounts get $250 in credit:

At WeAreDevelopers, Docker CISO Mark Lechner highlighted how most orgs have no visibility into what their agents can reach. His take: manage manifests as code, only run agents in observable environments. Cloud Sandboxes is the boundary that stays with your agent, even after you close your laptop. Try it yourself - for the next 3 days, new accounts get $250 in credit:

Docker

18,205 views • 1 month ago

Today we're introducing Cloud Sandboxes: same microVM isolation as Docker Sandboxes on your laptop, same CLI, always-on Docker-managed compute. Close your laptop. Keep the agent running. Move between local and cloud with one command. $250 credit for new accounts:

Today we're introducing Cloud Sandboxes: same microVM isolation as Docker Sandboxes on your laptop, same CLI, always-on Docker-managed compute. Close your laptop. Keep the agent running. Move between local and cloud with one command. $250 credit for new accounts:

Docker

533,470 views • 1 month ago

Don’t babysit your agents. Put them in sandboxes. Each sandbox is a microVM with its own kernel. And now they run in the cloud, too. Ready to try it out? New signups get $250 in Cloud Sandboxes credit. Claim yours before the promotion ends on October 31:

Don’t babysit your agents. Put them in sandboxes. Each sandbox is a microVM with its own kernel. And now they run in the cloud, too. Ready to try it out? New signups get $250 in Cloud Sandboxes credit. Claim yours before the promotion ends on October 31:

Docker

17,116 views • 23 days ago

Curious how NanoClaw + Docker Sandboxes actually work? This demo walks through setting up NanoClaw in a Docker Sandbox - connecting messaging accounts, configuring agent tools and access, and running agents inside an isolated MicroVM instead of on your machine. Watch the full demo and learn more →

Curious how NanoClaw + Docker Sandboxes actually work? This demo walks through setting up NanoClaw in a Docker Sandbox - connecting messaging accounts, configuring agent tools and access, and running agents inside an isolated MicroVM instead of on your machine. Watch the full demo and learn more →

Docker

14,711 views • 7 months ago

Docker Scout provides you just the right amount of info where and when you need it most. Get started with Scout:

Docker Scout provides you just the right amount of info where and when you need it most. Get started with Scout:

Docker

16,703 views • 3 years ago

Docker Sandboxes are everywhere right now. If you haven't tried them yet, Reynald Adolphe's latest covers what they are, why they matter, and how to spin one up, in just a few minutes. Plus: running multiple Sandboxes at once and side-by-side agent comparisons:

Docker Sandboxes are everywhere right now. If you haven't tried them yet, Reynald Adolphe's latest covers what they are, why they matter, and how to spin one up, in just a few minutes. Plus: running multiple Sandboxes at once and side-by-side agent comparisons:

Docker

16,920 views • 2 months ago

“Don't trust a model to govern a model." Mark Cavage's keynote at WeAreDevelopers covered: - New Cloud Sandbox offering - Sandbox Kit Spec, a common foundation for the agent ecosystem - Surprise guest Hervé Bizira from Nous Research Trust comes from the system around the agent. Watch:

“Don't trust a model to govern a model." Mark Cavage's keynote at WeAreDevelopers covered: - New Cloud Sandbox offering - Sandbox Kit Spec, a common foundation for the agent ecosystem - Surprise guest Hervé Bizira from Nous Research Trust comes from the system around the agent. Watch:

Docker

17,416 views • 1 month ago

TanStack AI runs coding agents in a sandbox now 📦 Agents: Grok build, Claude Code, Codex, OpenCode, or any ACP agent Sandboxes: Cloudflare, Docker, Local, Daytona or Vercel sandboxes Fully configurable sandboxes with skills, mcps and more! 🚀

TanStack AI runs coding agents in a sandbox now 📦 Agents: Grok build, Claude Code, Codex, OpenCode, or any ACP agent Sandboxes: Cloudflare, Docker, Local, Daytona or Vercel sandboxes Fully configurable sandboxes with skills, mcps and more! 🚀

TANSTACK

44,051 views • 4 months ago

Everyone is debating how much autonomy to give agents. What that conversation often skips is where humans need to stay in the loop. Watch the full episode for all of our CISO panelists’ takes on what this looks like in practice →

Everyone is debating how much autonomy to give agents. What that conversation often skips is where humans need to stay in the loop. Watch the full episode for all of our CISO panelists’ takes on what this looks like in practice →

Docker

10,838 views • 3 months ago

Agent adoption is “kind of the wild west right now”. Everyone is using agents on their laptops in their own way, with access to company files and every connected system. Zach Lloyd (Warp) and the CISO panel on what agent security actually requires:

Agent adoption is “kind of the wild west right now”. Everyone is using agents on their laptops in their own way, with access to company files and every connected system. Zach Lloyd (Warp) and the CISO panel on what agent security actually requires:

Docker

11,128 views • 2 months ago

Docker images are being built 39x faster with the next-gen Docker Build! Join the limited early preview program to gain access today:

Docker images are being built 39x faster with the next-gen Docker Build! Join the limited early preview program to gain access today:

Docker

93,544 views • 3 years ago

New in Hermes Agent: a credential firewall for Docker sandboxes. Your real keys never enter the sandbox. It runs on stand-in tokens, and a local proxy swaps in the real keys at the network boundary. Tokens from a compromised sandbox are useless elsewhere. > hermes egress setup

New in Hermes Agent: a credential firewall for Docker sandboxes. Your real keys never enter the sandbox. It runs on stand-in tokens, and a local proxy swaps in the real keys at the network boundary. Tokens from a compromised sandbox are useless elsewhere. > hermes egress setup

Nous Research

311,512 views • 3 months ago

Sandbox Kits are how you stop having the same "what did you install to get this working?" conversation. Reynald Adolphe on how one file defines your tools, config, and network rules, and travels with your project. Watch here:

Sandbox Kits are how you stop having the same "what did you install to get this working?" conversation. Reynald Adolphe on how one file defines your tools, config, and network rules, and travels with your project. Watch here:

Docker

15,198 views • 1 month ago

WeAreDevelopers is a wrap and we're still buzzing from it! Thank you for the thoughtful conversations, and the energy you brought to each session, and to the Sandbox Royale arena. You are the reason we do this. We hope you (and all your swag) have safe travels back home. Share your favorite WeAreDevelopers moments and pics below:

WeAreDevelopers is a wrap and we're still buzzing from it! Thank you for the thoughtful conversations, and the energy you brought to each session, and to the Sandbox Royale arena. You are the reason we do this. We hope you (and all your swag) have safe travels back home. Share your favorite WeAreDevelopers moments and pics below:

Docker

14,180 views • 1 month ago

"A developer has morals. It's very difficult to argue that an agent does." Allie Howe & Ian Livingstone (Keycard) Eli Aleyner (Docker), and Ezra Tanzer (Snyk) on agent identity, delegation patterns and what real governance looks like when agents are delegating work to other agents: Watch the full panel:

"A developer has morals. It's very difficult to argue that an agent does." Allie Howe & Ian Livingstone (Keycard) Eli Aleyner (Docker), and Ezra Tanzer (Snyk) on agent identity, delegation patterns and what real governance looks like when agents are delegating work to other agents: Watch the full panel:

Docker

17,044 views • 3 months ago