Docker Cloud Sandboxes Secure AI Agent Workflows in the Cloud
Docker launches Cloud Sandboxes, extending its secure isolation technology to the cloud for scalable, persistent AI agent execution.
Docker has introduced Docker Cloud Sandboxes, a new offering designed to provide secure, isolated execution environments for AI agents in the cloud. This solution aims to enable complex agentic workflows to run continuously, even after a developer's local machine is shut down. By moving agent execution off individual laptops and into a managed cloud infrastructure, organizations can scale their AI agent workloads without the burden of managing their own hardware or paying for idle capacity.
The need for such a solution arises from the evolving nature of AI agentic workflows. As these agents become more sophisticated, they are tasked with longer-running, unattended, and higher-stakes operations. Developers require the flexibility to run any agent on any model and the ability to transition execution to the cloud while maintaining the critical isolation and control necessary for safe operation. Docker Cloud Sandboxes extend the company's established local sandbox isolation into the cloud, offering developers a consistent experience whether they are working locally or remotely.
Mark Cavage, President at Docker, emphasized the shift in isolation requirements for modern agentic workflows. He noted that while traditional containers play a vital role, they were not originally designed for the stringent isolation demands of AI agents. The introduction of local sandboxes earlier this year was a step towards addressing this, and Cloud Sandboxes represent the extension of that same isolation and control to cloud environments. This ensures that developers can utilize the same sandbox with consistent policies, regardless of the execution location, empowering them to deploy agents for a wider range of tasks.
Docker Cloud Sandboxes build upon the foundation of Docker's local sandboxes, incorporating the same Command Line Interface (CLI), trust model, and Kits, but enhanced with elastic cloud capacity. Key benefits for developers include the ability to keep workflows running in the cloud even when their laptop is off, seamlessly shifting work from local development to the cloud without environment changes, and executing long-running jobs unattended. The sandboxes are designed for rapid startup, booting in milliseconds with pre-configured secrets, policies, and agent configurations.
Furthermore, the solution allows for scaling parallel tasks without requiring infrastructure provisioning, with compute scaling from 1 to 16 vCPUs managed by Docker. Developers can also build agent environments once and run them anywhere, locally or in the cloud, under identical controls. This unified approach simplifies development and deployment, ensuring consistency and reducing the potential for errors or security gaps.
Complementing its AI Governance solution, Docker's local and cloud sandboxes provide organizations with a foundational layer for enhanced control, security, and reliability in agent execution environments. Mat Velloso, Chief Product Officer at Docker, highlighted that while the productivity gains from AI are evident, the challenge of achieving these gains safely and with appropriate guardrails remains. Docker's sandboxes aim to solve this by offering a secure, model- and harness-neutral environment with deterministic policies that agents cannot bypass.
Docker also unveiled the next generation of Kits, an open specification for packaging agentic sandboxes. These Kits, now built as standard OCI images—the same open standard underpinning containers—ensure interoperability and prevent vendor lock-in. Developers can create and distribute Kits using familiar tools and processes, similar to publishing container images. Access rules are embedded within the Kit, enforcing enterprise-defined policies universally, thereby addressing historical control issues that hindered agent deployment.
Docker plans to submit the Kits specification to the Cloud Native Computing Foundation (CNCF) for neutral governance. Chris Aniszczyk, CTO at CNCF, noted that by using OCI images, Docker is providing the industry with an open, repeatable method for packaging AI agents, their tools, and guardrails. This move is expected to foster ecosystem growth and standardization within the cloud-native community.