I spent yesterday watching an agent do something genuinely useful inside a Docker Sandbox, and then almost do something genuinely stupid. The sandbox did its job. The stupid part was never going to be stopped by the sandbox.
Docker Sandboxes are a welcome step. Disposable, isolated, network-controlled environments for agents — spin one up, let the agent run wild, tear it down. No state leaks, no host access, no lingering files. That's real progress. I've run agents on bare hosts and I've run them in sandboxes, and I'm not going back. The blast radius is smaller and that matters.
The network control alone is worth it. I can give an agent a whitelist of endpoints and nothing else. It can't phone home, can't exfiltrate, can't reach my internal services. The filesystem is ephemeral — write all you want, it's gone when the container dies. Resource limits keep a runaway loop from eating the host. These are the right tools for the technical blast radius, and I use all of them.
The managed part matters too. Getting this as an API — spin up, run, tear down, all scriptable, all part of the agent loop — is the right shape. I've hand-rolled the same thing with plain docker and it works, but the managed version removes plumbing I'd rather not maintain.
But here's the thing nobody in the marketing copy says: the sandbox boundary is the wrong boundary. It's the right place to stop a filesystem write. It's the wrong place to stop a consequence.
Let me be concrete.
An agent inside a sandbox can still call an expensive API. It can still spin up cloud compute. It can still run a loop that burns tokens for six hours while you're asleep. The sandbox doesn't meter cost. It doesn't know what a dollar is. I had an agent last month get stuck in a retry loop against a paid API — the sandbox contained it perfectly, and the bill still made me wince. Isolation was flawless. Damage was done. The sandbox never saw a problem because from its perspective, nothing went wrong. It was just network calls, in sequence, for hours.
Same with publishing. A sandboxed agent can still POST to your blog. It can still send email. It can still merge a PR. The sandbox doesn't know what's consequential. It can't tell the difference between "write a draft file" and "publish a hit piece to 40,000 followers." From the sandbox's perspective, both are just network calls. And that's the gap.
The sandbox is a blast shield, not a babysitter. It contains the explosion. It doesn't decide whether the explosion should happen.
So what actually works? Human approval gates on consequential actions. Not on every action — that's just you doing the agent's job with extra steps. But on the ones with real-world consequences: spending money, publishing, sending messages, merging, deleting. The sandbox handles the technical blast radius. The approval gate handles the human blast radius. They're different problems and you need both.
The pattern I've settled on is boring on purpose. Every tool the agent can call is tagged with a consequence level. Read a file? Free. Write to a scratch dir? Free. Call an API? Free, up to a budget. Spend past the budget, publish, send, merge, delete? Blocked. The agent gets a message: "this action needs approval, here's what I'm about to do and why." I approve or I don't. That's it. No clever heuristics, no "trust the model to self-police." Just a hard gate on the handful of actions that can hurt me.
I've been running this for a while now. Sandbox for everything the agent does. Approval gate for the few things that have consequences outside the sandbox. The agent gets freedom inside — it can try, fail, retry, make a mess, tear it down. But the moment it wants to do something that matters beyond the container, it stops and asks. That's not paranoia. That's having been burned.
The mistake I keep seeing in the community is treating sandboxing as the whole answer. "Just sandbox your agents and you're safe." No. You're safer. There's a difference. Sandboxing is necessary and it is not sufficient. It's the floor, not the ceiling.
Docker Sandboxes are a good floor. I'll take them. But if you're building agentic systems, design the approval layer now, before the agent does something the sandbox can't stop. Because it will. Not because it's malicious — because it doesn't know what's consequential. And neither does the sandbox.
Top comments (0)