Running AI Coding Agents in Docker Sandboxes

AI coding agents like Claude Code can do a lot. They write code, install packages, run tests, manage files. But they do all of this directly on your host machine. That means they can see your filesystem, your environment variables, your SSH keys, your cloud credentials, and whatever else is on your local disk.

If you work in data engineering, your dev machine probably has database connection strings, API tokens for production systems, and config files with customer-facing credentials scattered around. I was not comfortable giving an AI agent unrestricted access to all of that.

I wanted a way to isolate these agents without giving up the convenience of running them locally. Docker Sandboxes does this well.

What Docker Sandboxes Does

Docker Sandboxes is an experimental feature from Docker that runs AI coding agents inside isolated microVMs on your local machine. Each sandbox gets its own Docker daemon, its own filesystem, and its own network boundary. The agent can execute commands, install packages, spin up containers, and do what it normally would, but none of it touches your host.

Your project directory syncs between the host and the sandbox at the same absolute path, so file references stay consistent. Beyond that shared workspace, the agent cannot see your other files, your running processes, or your host Docker daemon.

The agent gets full autonomy inside the sandbox, including what Docker calls “YOLO mode” where it works without prompting you for permission on every action. But it stays contained.

This feature requires Docker Desktop 4.58 or later. MicroVM-based sandboxes are currently supported on macOS and Windows (experimental). Linux users can use the legacy container-based sandboxes with Docker Desktop 4.57.

Full documentation is here: https://docs.docker.com/ai/sandboxes/

Getting Started

Make sure Docker Desktop is installed and updated to version 4.58 or later, then run:

# Create and start a new sandbox for your project
docker sandbox run claude ~/my-project

This creates a sandbox tied to your project workspace and starts a Claude Code session inside the isolated environment.

A few other commands you will use:

# List all active sandboxes
docker sandbox ls

# Resume a previously stopped sandbox by name
docker sandbox run <sandbox-name>

Sandboxes persist until you remove them. Packages you install, configuration you set up, and tools the agent pulls in will still be there when you come back.

Docker has a step-by-step setup guide here: https://docs.docker.com/ai/sandboxes/get-started/

I Built a Project This Way

I recently built CTE Flow, a tool that helps data engineers visualize the data flow of large, nested SQL views. The whole thing was built using Claude Code running inside a Docker Sandbox. The agent never had access to anything outside the project directory. I wanted to see if the workflow held up for a real development cycle, and it did.

Network Isolation

By default, a sandbox heavily restricts outbound network access. If you are running Claude Code, the sandbox only allows connections to Anthropic’s servers. Everything else is blocked.

Even if an agent does something unexpected, it cannot reach arbitrary endpoints, pull data out, or connect to internal services on your network. Private IP ranges (10.x, 172.16.x, 192.168.x), localhost, and cloud metadata services are all blocked by default.

If you need the agent to install dependencies, you can open access to specific package managers without opening up the rest of the internet. Docker provides configurable network policies with allowlist and denylist support at the domain level.

Full network policy documentation is here: https://docs.docker.com/ai/sandboxes/network-policies/

Worth Trying

If you have been putting off using AI coding agents because of privacy concerns, this is worth a look. The setup is quick, the isolation is handled at the VM level, and it works for real projects. The feature is still experimental and will probably change, but it already does what I needed it to do.