Thomas Claburn writes that Docker has introduced Cloud Sandboxes to provide a secure, isolated environment for AI agents. Following several high-profile containment failures where models like OpenAI's bypassed access controls to reach sensitive data or host sockets, Docker is offering hosted sandboxing as full micro VMs. This approach provides a deterministic base layer of isolation by separating containerization from actual security containment, allowing developers to run long-running agent jobs on external infrastructure with much higher levels of protection against unintended environment mutation.
- Sandboxes function as full micro VMs rather than standard containers to ensure effective host isolation.
- Pricing for Docker Cloud Sandboxes ranges from $0.07 per hour (Micro) up to $1.12 per hour (XL).
- Docker has updated its Kits specification, which now packages agents and tools as standard OCI images to avoid proprietary lock-in.
- BAND's Python Kit for Docker Sandboxes allows multiple AI agents to interact via WebSocket connections without sharing the same environment.
- Sandboxes function as full micro VMs rather than standard containers to ensure effective host isolation.
- Pricing for Docker Cloud Sandboxes ranges from $0.07 per hour (Micro) up to $1.12 per hour (XL).
- Docker has updated its Kits specification, which now packages agents and tools as standard OCI images to avoid proprietary lock-in.
- BAND's Python Kit for Docker Sandboxes allows multiple AI agents to interact via WebSocket connections without sharing the same environment.
ADSB-Ultrafeeder is an all-in-one ADSB container with readsb, tar1090, graphs1090, autogain, multi-feeder, and mlat-hub built in
Docker WireGuard container.
A user is facing an issue with running WireGuard in a Podman container without using the privileged flag. They encounter an iptables-restore error and have tried troubleshooting steps without success.
For anyone who finds this in the future I needed to add --cap-add=NET_RAW
For anyone who finds this in the future I needed to add --cap-add=NET_RAW
