Docker sandbox
Also known as: container sandbox
A Docker sandbox runs an agent’s workloads inside containers: isolated filesystem, limited CPU/memory, controlled network.
- Spin up per task, tear down after — disposable by design.
- Cheap and fast compared to VMs.
- Network can be cut off entirely for full isolation.
Why Docker wins for agents: isolation with near-zero overhead. A container that lives for 30 seconds and dies is exactly the lifetime an agent task needs.