Docker turns coding-agent sandboxes into movable cloud compute — and packages their authority as OCI

On September 24, 2026, Docker launched Cloud Sandboxes and Sandbox Kit Specification v3. Cloud Sandboxes extend Docker’s local microVM-based agent environments onto Docker-managed compute, with the same sbx CLI and a move operation that captures a sandbox filesystem and recreates it on the other side. Docker also published Kits as ordinary OCI images that describe an agent, its tools and typed access requirements such as credentials, network destinations and volumes. The Kit spec is Apache-2.0 licensed and Docker says it intends to submit it to the CNCF for neutral governance. Docker also exposed an experimental TypeScript SDK and REST API for programmatic cloud-sandbox creation, command execution, file transfer, snapshots, volumes and secrets.

Coding agents increasingly run long enough that the developer laptop becomes an awkward execution boundary. Docker is treating the agent environment as portable compute: start locally, move the filesystem to cloud capacity, run parallel work, then bring it back. The more interesting architectural piece may be Kits. If agent identity, tools and requested authority can travel as a versioned OCI artifact, teams can review and distribute an agent environment through familiar registry, signing and scanning workflows instead of rebuilding permissions manually on every machine. That does not make permissions safe by itself: enforcement still belongs to the runtime, and Docker Sandboxes is currently the concrete enforcement environment.

Docker’s sbx tooling now targets both local microVM sandboxes and Docker-managed cloud sandboxes. The `sbx move` workflow captures the filesystem and recreates the sandbox on the destination, so a developer can iterate locally and hand longer work to cloud compute. Docker documents cloud sizes from 1 vCPU/2 GiB to 16 vCPUs/32 GiB and bills compute by the second.

Docker’s published pricing starts at $0.07 per hour for 1 vCPU/2 GiB and reaches $1.12 per hour for 16 vCPUs/32 GiB. Paused sandboxes cost nothing, while model-provider usage remains separate and can use the developer’s own API key. That makes the product closer to disposable agent compute than an all-inclusive coding-agent subscription.

Sandbox Kit Specification v3 uses ordinary OCI images rather than inventing a new package format. A Kit can describe the base environment, agent, tools, network rules and credentials it needs. Docker’s framing is effectively authority-as-code: access requirements become versioned and reviewable alongside the environment, and the artifact can use existing OCI registry workflows.

A Kit declaring an access rule does not independently enforce it. The runtime has to interpret and enforce those declarations. Docker Sandboxes is the initial implementation, and Docker says it intends to move the specification toward CNCF neutral governance so other runtimes can implement it.

Docker’s experimental Sandboxes API and TypeScript SDK can create and manage cloud sandboxes, run commands, transfer files and work with snapshots, volumes and secrets. That creates a path for SaaS products and internal platforms to allocate isolated agent compute themselves rather than requiring a developer to launch each session manually.