Docker is the default answer for "how do you sandbox an AI agent?"
It's the wrong answer for most people.
The Docker tax
Setting up a Docker container for every AI task:
- Write a Dockerfile
- Build the image
- Mount the right volumes
- Deal with filesystem permissions
- Wait for the container to start
- Learn Docker if you don't already know it
That's 30 minutes of setup per task. For a sandbox that's supposed to save you time.
The 10-second alternative
On Windows, you can map any folder to a drive letter:
subst Z: C:i-workspaces ask-1
Point your AI tool at Z:\. Done.
No Dockerfile. No volumes. No permissions. No waiting.
Why this works
Because it's an OS-level boundary. The filesystem enforces it, not Docker.
The agent can do whatever it wants inside that drive. It can't see anything outside of it. Same guarantee as Docker, 10 seconds instead of 30 minutes.
The tool
I use ScsSubst (https://subst.scsoi.com/) to manage these mapped drives. $9.99 lifetime, one-time purchase. It makes persistent mappings that survive reboots, and gives you a GUI to manage all your drives.
When you actually need Docker
If you're running untrusted code from the internet, sure, use Docker. But if you're running your own AI coding assistant on your own machine, and you just want to make sure it can't accidentally delete your home folder — a mapped drive letter is enough.
The bottom line
Docker is great for deploying apps. It's overkill for sandboxing AI agents.
A mapped drive letter is simpler, faster, and gives you the same guarantee.
Top comments (0)