Blog
2 min read

Docker Launches Cloud Sandboxes for AI Agents — and Open Kits on OCI

On 24 September 2026 Docker launched Cloud Sandboxes, extending its local agent sandboxes to Docker-managed cloud infrastructure with the same microVM isolation, policies and CLI, boot times in the low hundreds of milliseconds and 1–16 vCPUs. It also published next-generation Kits, an OCI-based spec for packaging an agent, its tools and its access rules.

On 24 September 2026, at WeAreDevelopers North America, Docker launched Cloud Sandboxes: a cloud version of the local sandboxes it introduced for running AI agents, so agent work can keep running after your laptop shuts down. (What Is Docker?)

What Cloud Sandboxes offer

Docker says cloud sandboxes share the same CLI, trust model and Kits as local sandboxes:

  • Start locally, shift to the cloud without changing environments.
  • Boot in the low hundreds of milliseconds, with secrets, policies, MCP gateways and agent configuration already in place.
  • Scale from 1 to 16 vCPUs, managed by Docker.
  • Run agents "with the same microVM isolation and policies as local sandboxes."

Docker's own framing is notable: it says containers "weren't designed for the level of isolation AI agents demand", which is why sandboxes use microVMs rather than plain containers. (Containers vs Virtual Machines, Firecracker vs gVisor vs Containers)

The press release didn't include pricing.

Kits: packaging an agent as an OCI image

Docker also published the next generation of Kits, an open spec for packaging an agentic sandbox — the agent, its tools and its access rules — as one shareable artifact:

  • Kits are standard OCI images, published like any container image.
  • Access rules are embedded and enforced wherever the Kit runs — locally or in the cloud — so the agent can't change its own policy.
  • Kits can be composed from mixins, so a platform team can standardise some parts while teams customise others.
  • Docker plans to submit the spec to the CNCF; it's on GitHub at docker/sandbox-kit-spec.

How it fits the market

Agent isolation is crowded: Vercel Sandbox, E2B, Modal, Cloudflare's rebuilt Containers, OpenAI's Codex cloud environments and Cursor's self-hosted machines all launched or expanded features in the same few weeks. Most are built around ephemeral sandboxes created per task. Docker's "start local, continue in the cloud" approach, and Codex's new persistent environments, show the other need: agents working for hours on the same environment. (The Sandbox Is the Wrong Abstraction, OpenAI DevDay 2026: Codex)

What to consider

  • What runs inside matters as much as the wall around it. Isolation stops escapes; it doesn't stop an agent misusing credentials you put inside the sandbox. Scope secrets and network egress tightly. (Agent Egress Control)
  • Persistence vs disposal. Decide which state should survive between runs — dependencies, databases, caches — and which should be thrown away. (Why AI Coding Agents Need Persistent Workspaces)

Source: Docker press release: Cloud Sandboxes

EasySpawn gives each server its own VM — strong isolation, but persistent: your app, database and Claude Code stay put between sessions instead of being rebuilt per task. See how it works or join the waitlist.

Related: Kata Containers · Firecracker Snapshots · Run Untrusted AI-Generated Code Safely · Docker vs Linux Users for Multi-Tenant Isolation

Keep reading