DEV Community

Cover image for Running Coding Agents + Docker Inside the Sandbox
Koti Vellanki
Koti Vellanki

Posted on

Running Coding Agents + Docker Inside the Sandbox

#ai #docker #containers #agents

Blog 3 — Docker Sandboxes Series

What We Are Building

By the end of this blog you will:

  • Launch real coding agents (Claude, Gemini, Codex, Copilot, OpenCode, Kiro, etc.) inside a sandbox
  • Give an agent an actual development task and watch it work safely
  • Use the isolated Docker daemon that lives inside every sandbox to build and run containers
  • Prove that nothing touches your host Docker or host system packages

This is the point where sandboxes stop being a demo and become a daily tool.

Why This Matters

In the first two blogs we built a safe environment and learned how to control files, network and secrets.

Now we put a real agent inside that environment. The agent can install packages, edit code, run tests and build Docker images — all without risk to your laptop.

The key design point is this: every sandbox comes with its own Docker daemon. The agent can run docker build, docker run and even docker compose freely. Those containers live only inside the microVM. Your host Docker stays completely untouched.

What You Should Know Before Starting

  • Blogs 1 and 2 completed
  • A free Docker account (already signed in)
  • At least one of the following (optional but recommended):
    • Anthropic API key or Claude subscription (for claude)
    • OpenAI API key (for codex)
    • Google API key (for gemini)
    • Or just use the shell agent if you have no keys yet

We will show both paths.

Step 1: Environment Setup

Clean any old sandboxes:

sbx ls
sbx stop $(sbx ls -q) 2>/dev/null || true
sbx rm $(sbx ls -q) 2>/dev/null || true
Enter fullscreen mode Exit fullscreen mode

sbx ls

Create a realistic small project:

mkdir -p agent-lab
cd agent-lab
Enter fullscreen mode Exit fullscreen mode

Store secrets if you have them (examples):

# Anthropic (Claude)
sbx secret set anthropic

# or OpenAI (Codex)
# sbx secret set openai

# GitHub (useful for most agents)
sbx secret set github -t "$(gh auth token)" 2>/dev/null || true
Enter fullscreen mode Exit fullscreen mode

Recommended Method (Claude Subscription – Pro / Max / Team / Enterprise)

You do not need to run sbx secret set anthropic.

Exact steps:

  1. Start Claude Code Inside the Sandbox: 
   sbx run --name agent-lab --clone claude
Enter fullscreen mode Exit fullscreen mode

(or whatever name/workspace you are using)
What happens:

  • A new microVM starts
  • Claude Code launches inside it
  • You will see the Claude Code interface

You are now inside Claude Code (running inside the sandbox).

start claude sbx

  1. Once Claude Code starts inside the sandbox, type this command: 
   /login
Enter fullscreen mode Exit fullscreen mode

claude login

  1. Claude will open a browser window (or give you a link) for OAuth login.

  2. Sign in with your Claude subscription account (the same one you use on claude.ai).

  3. After successful login you will see something like:

   Login successful
Enter fullscreen mode Exit fullscreen mode

login success browser

login success local

  1. You can now start chatting with Claude. The session token stays on your host and is never stored inside the sandbox.

Step 2 — Ask Claude to Create the Application

Still inside the Claude Code session, paste this prompt:

Create a simple Flask application with these files:

1. app.py – A Flask app that has two routes:
   - / → returns "Hello from Docker Sandbox!"
   - /health → returns {"status": "ok"}

2. requirements.txt – contains flask

3. Dockerfile – Use python:3.12-slim, install requirements, expose port 5000, and run the app.

Make the code clean and production-ready.
Enter fullscreen mode Exit fullscreen mode

Claude will create the files for you.

creating app with claude

Step 3 — Use Docker Inside the Sandbox

You now have two clean ways to work with Docker.

Method A: Let Claude do everything (Recommended)

Still inside Claude Code, type:

Build the Docker image, run the container on port 5000, and test both endpoints using curl.
Enter fullscreen mode Exit fullscreen mode

Claude will run all the Docker commands itself.

build image run container

Method B: Run Docker commands yourself (Manual control)

If you want to type the Docker commands yourself, follow these exact steps:

  1. Keep the Claude Code terminal open (do not close it).

  2. Open a new terminal on your host machine and run:

sbx exec -it agent-lab bash
Enter fullscreen mode Exit fullscreen mode

You are now inside a normal Linux shell inside the same sandbox.

  1. Run these commands one by one: 
docker build -t agent-lab-app .
docker images
docker run -d -p 5000:5000 --name demo agent-lab-app
docker ps
curl http://localhost:5000
curl http://localhost:5000/health
Enter fullscreen mode Exit fullscreen mode
  1. When finished, type exit to leave this shell. The Claude Code session in the other terminal remains running.

Important Notes (Read Carefully)

Situation What to do
You pressed Ctrl + C or Ctrl + X and Claude stopped Just run sbx run --name agent-lab again
You want a normal shell Use sbx exec -it agent-lab bash
You want Claude to do the work Stay in the Claude Code terminal and give instructions
You want to check running containers Use sbx exec -it agent-lab bash then docker ps

sbx exec

Step 4 — Publish the Port (Optional)

If you want to access the app from your host browser:

On your sandbox run app:

running app in sbx

On your host machine run:

sbx ports agent-lab --publish 8080:5000
Enter fullscreen mode Exit fullscreen mode

Then open: http://localhost:8080

sbx port publish

Step 5 — Clean Up

When you are finished:

# On host machine
sbx stop agent-lab
sbx rm agent-lab
Enter fullscreen mode Exit fullscreen mode

sbx cleanup

References

All commands and behaviour verified against current official documentation (August 2026).

Top comments (0)