I’ve been watching the container ecosystem for years, and I think we’re at an inflection point. The abstractions that made sense for stateless applications are starting to crack under the weight of something new: AI agents that actually do things.
At WeAreDevelopers North America, Docker’s Mark Cavage showed us what that crack looks like. He ran a demo where an AI agent pushed beyond its container’s limits. The container worked as designed. The problem was that containers were never meant to isolate agents. They were built to isolate applications.
Applications consume resources. Agents consume resources and make decisions. They install dependencies, access networks, use credentials, and keep working after we’ve moved on. That’s fundamentally different. And if you’re going to give an agent that kind of autonomy, you need a boundary that actually means something.
Isolation That Scales With Trust
Enter Docker Sandboxes. Each agent gets its own isolated microVM with its own kernel, completely separate from your host environment. But here’s the part that actually matters: the sandbox boundary extends to the agent’s full environment. Files, networks, secrets, everything.
Developers define access policies separately, outside the agent’s control. The agent can’t modify its own permissions. That’s the trust model that matters. You’re not trusting the agent; you’re trusting the infrastructure around it.
This is available now through the free CLI. If you’re already using agents in your workflow, stronger isolation is a one-command upgrade. For most teams, that’s compelling enough. But Docker went further.
Making Authority Reproducible
Docker Sandbox Kits are the output of this thinking. They’re built as standard OCI images, which means they’re versioned, shareable, and reviewable through the same workflows you already use for containers.
Here’s what matters: a Kit packages the agent, its tools, and the rules for what it can access into a single artifact. When permissions change, that change is visible in version control. You can diff it. You can review it. You can understand what a new version of an agent is actually allowed to do.
Dockerfiles made software reproducible. Kits make authority reproducible. That distinction might sound small. It’s not. It’s the difference between deploying an agent and understanding what you deployed.
Docker is taking this to the CNCF, which means the Kits specification becomes vendor-neutral infrastructure that the entire industry can build on. That’s how you avoid lock-in at the agent layer.
The Local-to-Cloud Continuum
But there’s a practical problem that local sandboxes don’t solve. Some agent work needs to keep running after you close your laptop. It needs durable capacity. It needs to scale beyond one machine.
Docker Cloud Sandboxes extend the same microVM-based isolation to managed cloud compute. You start locally with the same sbx workflow. When you need more capacity, you move it to the cloud with one command. The agent keeps running. The isolation model stays the same. The access policies travel with it.
Pay-as-you-go pricing means you’re not provisioning infrastructure ahead of time. You’re not maintaining it either. You’re just choosing where the work runs based on what makes sense for that moment.
An Ecosystem Built on Choice
Nous Research showed up at the keynote to demonstrate Hermes running as a first-class Kit in Docker Sandboxes. That demo was really about choice. Developers can pick the agent that fits their work best without having to rebuild the security layer underneath it.
That only works if the foundation is truly open. If the Kits specification lives at the CNCF, third-party agents can target it. If Docker provides the sandboxes on the laptop and in the cloud, developers can move work between environments without rewiring their infrastructure.
I think this is the shape of the agent ecosystem we need. Not Docker owning everything. Not agents running unconstrained. But a clear separation of concerns: agents handle the reasoning and action, sandboxes handle the boundaries, and standards make it all work together.
The infrastructure around autonomous systems matters more than the infrastructure around static applications ever did. Get it right, and developers keep more control while agents get more freedom. Get it wrong, and you get a lot of very fast mistakes at scale.