Skip to content

Commit f48305d

Browse files
dvdksndvdksn
authored
sandboxes 0.10.1 (#24059)
- **cli: docker sandboxes v0.10.1** - **sandboxes: add `docker sandbox save` to templates docs** - **sandboxes: add copilot to supported agents** - **sandboxes: call out yolo mode by default in overview** --------- Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
2 parents 53aa093 + 9f5390e commit f48305d

File tree

9 files changed

+183
-45
lines changed

9 files changed

+183
-45
lines changed

‎content/manuals/ai/sandboxes/_index.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ environment without affecting your host.
2727
You get:
2828

2929
- Agent autonomy without host system risk
30+
- YOLO mode by default - agents work without asking permission
3031
- Private Docker daemon for running test containers
3132
- File sharing between host and sandbox
3233
- Network access control
@@ -85,6 +86,7 @@ Docker Sandboxes works with multiple AI coding agents:
8586

8687
- **Claude Code** - Anthropic's coding agent
8788
- **Codex** - OpenAI's Codex agent (partial support; in development)
89+
- **Copilot** - GitHub Copilot agent (partial support; in development)
8890
- **Gemini** - Google's Gemini agent (partial support; in development)
8991
- **cagent** - Docker's [cagent](/ai/cagent/) (partial support; in development)
9092
- **Kiro** - by AWS (partial support; in development)

‎content/manuals/ai/sandboxes/agents.md‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,13 +11,14 @@ inside microVMs with private Docker daemons.
1111

1212
## Supported agents
1313

14-
| Agent | Command | Status | Notes |
15-
| ----------- | -------- | ------------ | -------------------------- |
16-
| Claude Code | `claude` | Experimental | Most tested implementation |
17-
| Codex | `codex` | Experimental | In development |
18-
| Gemini | `gemini` | Experimental | In development |
19-
| cagent | `cagent` | Experimental | In development |
20-
| Kiro | `kiro` | Experimental | In development |
14+
| Agent | Command | Status | Notes |
15+
| ----------- | ---------- | ------------ | -------------------------- |
16+
| Claude Code | `claude` | Experimental | Most tested implementation |
17+
| Codex | `codex` | Experimental | In development |
18+
| Copilot | `copilot` | Experimental | In development |
19+
| Gemini | `gemini` | Experimental | In development |
20+
| cagent | `cagent` | Experimental | In development |
21+
| Kiro | `kiro` | Experimental | In development |
2122

2223
## Experimental status
2324

@@ -37,6 +38,7 @@ The agent type is specified when creating a sandbox:
3738
```console
3839
$ docker sandbox create claude ~/my-project
3940
$ docker sandbox create codex ~/my-project
41+
$ docker sandbox create copilot ~/my-project
4042
$ docker sandbox create gemini ~/my-project
4143
$ docker sandbox create cagent ~/my-project
4244
$ docker sandbox create kiro ~/my-project

‎content/manuals/ai/sandboxes/templates.md‎

Lines changed: 67 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ Use custom templates when:
2222
For one-off work or simple setups, use the default template and ask the agent
2323
to install what's needed.
2424

25-
## Building a template
25+
## Building templates with Dockerfiles
2626

2727
Start from Docker's official sandbox templates:
2828

@@ -46,9 +46,9 @@ RUN pip3 install --no-cache-dir \
4646
USER agent
4747
```
4848

49-
Official templates include the agent binary, Ubuntu base, development tools
50-
(Git, Docker CLI, Node.js, Python, Go), and the non-root `agent` user with
51-
sudo access.
49+
Official templates include the agent binary, Ubuntu base, and development tools
50+
like Git, Docker CLI, Node.js, Python, and Go. They run as the non-root
51+
`agent` user with sudo access.
5252

5353
### The USER pattern
5454

@@ -57,42 +57,74 @@ end. The base template defaults to `USER agent`, so you need to explicitly
5757
switch to root for package installations. Always switch back to `agent` before
5858
the end of your Dockerfile so the agent runs with the correct permissions.
5959

60-
### Using templates
60+
### Using templates built from Dockerfiles
6161

6262
Build your template:
6363

6464
```console
6565
$ docker build -t my-template:v1 .
6666
```
6767

68-
Then choose how to use it:
69-
70-
Option 1: Load from local images (quick, for personal use)
68+
Use it directly from your local Docker daemon:
7169

7270
```console
73-
$ docker sandbox create --template my-template:v1 \
74-
--load-local-template \
75-
claude ~/project
76-
$ docker sandbox run <sandbox-name>
71+
$ docker sandbox run --load-local-template -t my-template:v1 claude ~/project
7772
```
7873

79-
The `--load-local-template` flag loads the image from your local Docker daemon
80-
into the sandbox VM. This works for quick iteration and personal templates.
74+
The `--load-local-template` flag tells the sandbox to use an image from your
75+
local Docker daemon. Without it, the sandbox looks for the image in a registry.
8176

82-
Option 2: Push to a registry (for sharing and persistence)
77+
To share the template with others, push it to a registry:
8378

8479
```console
8580
$ docker tag my-template:v1 myorg/my-template:v1
8681
$ docker push myorg/my-template:v1
87-
$ docker sandbox create --template myorg/my-template:v1 claude ~/project
88-
$ docker sandbox run <sandbox-name>
82+
$ docker sandbox run -t myorg/my-template:v1 claude ~/project
8983
```
9084

91-
Pushing to a registry makes templates available to your team and persists them
92-
beyond your local machine.
85+
Once pushed to a registry, you don't need `--load-local-template`.
86+
87+
## Creating templates from existing sandboxes
88+
89+
Rather than writing a Dockerfile, you can start with a sandbox, configure it,
90+
then save it as a template. This is convenient when you already have a working
91+
environment set up by the agent.
92+
93+
Start a sandbox and have the agent install what you need:
94+
95+
```console
96+
$ docker sandbox run claude ~/project
97+
```
98+
99+
Inside the sandbox, ask the agent to install tools and configure the
100+
environment. Once everything works, exit and save the sandbox as a template:
101+
102+
```console
103+
$ docker sandbox save claude-sandbox-2026-02-02-123456 my-template:v1
104+
✓ Saved sandbox as my-template:v1
105+
```
106+
107+
This saves the image to your local Docker daemon. Use `--load-local-template`
108+
to create new sandboxes from it:
109+
110+
```console
111+
$ docker sandbox run --load-local-template -t my-template:v1 claude ~/other-project
112+
```
113+
114+
To save as a tar file instead (for example, to transfer to another machine):
115+
116+
```console
117+
$ docker sandbox save -o template.tar claude-sandbox-2026-02-02-123456 my-template:v1
118+
```
119+
120+
Use a Dockerfile when you want a clear record of how the environment is built.
121+
Use `docker sandbox save` when you already have a working sandbox and want to
122+
reuse it.
93123

94124
## Example: Node.js template
95125

126+
This template adds Node.js 20 and common development tools:
127+
96128
```dockerfile
97129
FROM docker/sandbox-templates:claude-code
98130

@@ -108,14 +140,14 @@ RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
108140

109141
# Install common tools
110142
RUN npm install -g \
111-
typescript@5.1.6 \
112-
eslint@8.46.0 \
113-
prettier@3.0.0
143+
typescript@5.7.2 \
144+
eslint@9.17.0 \
145+
prettier@3.4.2
114146

115147
USER agent
116148
```
117149

118-
Pin versions for reproducible builds.
150+
Pin specific versions for reproducible builds across your team.
119151

120152
## Using standard images
121153

@@ -138,21 +170,28 @@ dependencies, configure the shell, and set up the `agent` user. Building from
138170

139171
## Sharing with teams
140172

141-
Push templates to a registry and version them:
173+
To share templates, push them to a registry with version tags:
142174

143175
```console
144176
$ docker build -t myorg/sandbox-templates:python-v1.0 .
145177
$ docker push myorg/sandbox-templates:python-v1.0
146178
```
147179

148-
Team members can then use the template:
180+
Or tag and push a saved sandbox:
181+
182+
```console
183+
$ docker tag my-template:v1 myorg/my-template:v1.0
184+
$ docker push myorg/my-template:v1.0
185+
```
186+
187+
Team members use the template by referencing the registry image:
149188

150189
```console
151-
$ docker sandbox create --template myorg/sandbox-templates:python-v1.0 claude ~/project
190+
$ docker sandbox run -t myorg/sandbox-templates:python-v1.0 claude ~/project
152191
```
153192

154-
Using version tags (`:v1.0`, `:v2.0`) instead of `:latest` ensures stability
155-
across your team.
193+
Use version tags like `:v1.0` instead of `:latest` for consistency across your
194+
team.
156195

157196
## Next steps
158197

‎content/reference/cli/docker/sandbox/create/copilot.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
datafolder: sandbox-cli
3+
datafile: docker_sandbox_create_copilot
4+
title: docker sandbox create copilot
5+
layout: cli
6+
---

‎content/reference/cli/docker/sandbox/save.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
datafolder: sandbox-cli
3+
datafile: docker_sandbox_save
4+
title: docker sandbox save
5+
layout: cli
6+
---

‎data/sandbox-cli/docker_sandbox.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ cname:
1212
- docker sandbox reset
1313
- docker sandbox rm
1414
- docker sandbox run
15+
- docker sandbox save
1516
- docker sandbox stop
1617
- docker sandbox version
1718
clink:
@@ -22,6 +23,7 @@ clink:
2223
- docker_sandbox_reset.yaml
2324
- docker_sandbox_rm.yaml
2425
- docker_sandbox_run.yaml
26+
- docker_sandbox_save.yaml
2527
- docker_sandbox_stop.yaml
2628
- docker_sandbox_version.yaml
2729
options:

‎data/sandbox-cli/docker_sandbox_create_copilot.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
command: docker sandbox create copilot
2+
short: Create a sandbox for copilot
3+
long: |-
4+
Create a sandbox with access to a host workspace for copilot.
5+
6+
The workspace path is required and will be exposed inside the sandbox at the same path as on the host.
7+
8+
Use 'docker sandbox run SANDBOX' to start copilot after creation.
9+
usage: docker sandbox create copilot WORKSPACE
10+
pname: docker sandbox create
11+
plink: docker_sandbox_create.yaml
12+
inherited_options:
13+
- option: debug
14+
shorthand: D
15+
value_type: bool
16+
default_value: "false"
17+
description: Enable debug logging
18+
deprecated: false
19+
hidden: false
20+
experimental: false
21+
experimentalcli: false
22+
kubernetes: false
23+
swarm: false
24+
- option: socket
25+
value_type: string
26+
description: |
27+
Connect to daemon at specific socket path (for development/debugging)
28+
deprecated: false
29+
hidden: true
30+
experimental: false
31+
experimentalcli: false
32+
kubernetes: false
33+
swarm: false
34+
deprecated: false
35+
hidden: false
36+
experimental: false
37+
experimentalcli: false
38+
kubernetes: false
39+
swarm: false
40+

‎data/sandbox-cli/docker_sandbox_run.yaml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,6 @@ long: |-
44
Run an agent in a sandbox. Create the sandbox if it does not exist.
55
66
Pass agent arguments after the "--" separator.
7-
8-
Examples:
9-
# Create and run a sandbox with claude in current directory
10-
docker sandbox run claude .
11-
12-
# Run an existing sandbox
13-
docker sandbox run existing-sandbox
14-
15-
# Run a sandbox with agent arguments
16-
docker sandbox run claude . -- -p "What version are you running?"
177
usage: docker sandbox run SANDBOX [-- AGENT_ARGS...] | AGENT WORKSPACE [-- AGENT_ARGS...]
188
pname: docker sandbox
199
plink: docker_sandbox.yaml

‎data/sandbox-cli/docker_sandbox_save.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
command: docker sandbox save
2+
short: Save a snapshot of the sandbox as a template
3+
long: |-
4+
Save a snapshot of the sandbox as a template.
5+
6+
By default, the image is loaded into the host's Docker daemon (requires Docker to be running).
7+
Use --output to save the image to a tar file instead.
8+
usage: docker sandbox save SANDBOX TAG
9+
pname: docker sandbox
10+
plink: docker_sandbox.yaml
11+
options:
12+
- option: output
13+
shorthand: o
14+
value_type: string
15+
description: |
16+
Save image to specified tar file instead of loading into host Docker
17+
deprecated: false
18+
hidden: false
19+
experimental: false
20+
experimentalcli: false
21+
kubernetes: false
22+
swarm: false
23+
inherited_options:
24+
- option: debug
25+
shorthand: D
26+
value_type: bool
27+
default_value: "false"
28+
description: Enable debug logging
29+
deprecated: false
30+
hidden: false
31+
experimental: false
32+
experimentalcli: false
33+
kubernetes: false
34+
swarm: false
35+
- option: socket
36+
value_type: string
37+
description: |
38+
Connect to daemon at specific socket path (for development/debugging)
39+
deprecated: false
40+
hidden: true
41+
experimental: false
42+
experimentalcli: false
43+
kubernetes: false
44+
swarm: false
45+
deprecated: false
46+
hidden: false
47+
experimental: false
48+
experimentalcli: false
49+
kubernetes: false
50+
swarm: false
51+

0 commit comments

Comments
 (0)