# Docker turns coding-agent sandboxes into movable cloud compute — and packages their authority as OCI Docker Cloud Sandboxes can move an agent workspace between a laptop and Docker-managed microVM compute, while the new Sandbox Kit specification packages the agent, tools and requested access as an OCI artifact. The useful shift is that execution environment and authority are becoming reproducible infrastructure rather than per-developer setup. Docker’s new agent stack combines pay-as-you-go microVM sandboxes with an OCI-based Kit format for declaring what an agent can use. Cloud sessions cost from $0.07 to $1.12 an hour, and Docker says it plans to take the Kit specification toward CNCF neutral governance. - Status: Active - Published: 2026-09-26T14:36:13+12:00 - Updated: 2026-09-26T14:36:13+12:00 - Categories: Artificial Intelligence, Web Development, Cloud & Infrastructure, AI Agents, AI Coding, Deployment & DevOps, Developer Tools - Tags: AI agents, Coding agents, Developer tools, Docker, OCI, sandboxing - Canonical HTML: https://beyondthe.news/dossiers/docker-cloud-sandboxes-oci-kit-agent-permissions ## What changed On September 24, 2026, Docker launched Cloud Sandboxes and Sandbox Kit Specification v3. Cloud Sandboxes extend Docker’s local microVM-based agent environments onto Docker-managed compute, with the same sbx CLI and a move operation that captures a sandbox filesystem and recreates it on the other side. Docker also published Kits as ordinary OCI images that describe an agent, its tools and typed access requirements such as credentials, network destinations and volumes. The Kit spec is Apache-2.0 licensed and Docker says it intends to submit it to the CNCF for neutral governance. Docker also exposed an experimental TypeScript SDK and REST API for programmatic cloud-sandbox creation, command execution, file transfer, snapshots, volumes and secrets. ## Why it matters Coding agents increasingly run long enough that the developer laptop becomes an awkward execution boundary. Docker is treating the agent environment as portable compute: start locally, move the filesystem to cloud capacity, run parallel work, then bring it back. The more interesting architectural piece may be Kits. If agent identity, tools and requested authority can travel as a versioned OCI artifact, teams can review and distribute an agent environment through familiar registry, signing and scanning workflows instead of rebuilding permissions manually on every machine. That does not make permissions safe by itself: enforcement still belongs to the runtime, and Docker Sandboxes is currently the concrete enforcement environment. ## A sandbox can move between local and cloud execution Docker’s sbx tooling now targets both local microVM sandboxes and Docker-managed cloud sandboxes. The `sbx move` workflow captures the filesystem and recreates the sandbox on the destination, so a developer can iterate locally and hand longer work to cloud compute. Docker documents cloud sizes from 1 vCPU/2 GiB to 16 vCPUs/32 GiB and bills compute by the second. ## Cloud compute is deliberately separate from model inference Docker’s published pricing starts at $0.07 per hour for 1 vCPU/2 GiB and reaches $1.12 per hour for 16 vCPUs/32 GiB. Paused sandboxes cost nothing, while model-provider usage remains separate and can use the developer’s own API key. That makes the product closer to disposable agent compute than an all-inclusive coding-agent subscription. ## Kits turn agent authority into a registry artifact Sandbox Kit Specification v3 uses ordinary OCI images rather than inventing a new package format. A Kit can describe the base environment, agent, tools, network rules and credentials it needs. Docker’s framing is effectively authority-as-code: access requirements become versioned and reviewable alongside the environment, and the artifact can use existing OCI registry workflows. ## The specification and enforcement are different layers A Kit declaring an access rule does not independently enforce it. The runtime has to interpret and enforce those declarations. Docker Sandboxes is the initial implementation, and Docker says it intends to move the specification toward CNCF neutral governance so other runtimes can implement it. ## Programmatic sandboxes make this infrastructure, not just a CLI feature Docker’s experimental Sandboxes API and TypeScript SDK can create and manage cloud sandboxes, run commands, transfer files and work with snapshots, volumes and secrets. That creates a path for SaaS products and internal platforms to allocate isolated agent compute themselves rather than requiring a developer to launch each session manually. ## Key details - Docker Cloud Sandboxes launched September 24, 2026 and use Docker-managed microVM-based execution. - The same sbx workflow covers local and cloud sandboxes, including moving a sandbox filesystem between them. - Published cloud compute pricing ranges from $0.07/hour for 1 vCPU and 2 GiB to $1.12/hour for 16 vCPUs and 32 GiB, billed by the second. - Sandbox Kit Specification v3 packages an agent, tools and access requirements using ordinary OCI artifacts. - The Kit specification is Apache-2.0 licensed and Docker says it plans CNCF neutral governance. - Docker’s Sandboxes API and TypeScript SDK are currently experimental. - Model inference charges are separate from Docker sandbox compute. ## Builder takeaways - Treat long-running coding agents as compute workloads rather than processes that must remain attached to a laptop. - Version agent permissions and tooling with the execution environment where possible; Docker’s Kit model makes those grants inspectable instead of implicit workstation state. - Do not confuse a portable permission declaration with enforcement. Evaluate the runtime that actually applies network, credential and filesystem policy. - Compare cloud-sandbox compute separately from model-token cost; Docker’s published prices cover the execution machine, not inference. - The API/SDK makes isolated agent workers usable as a backend primitive for your own automation, but it is experimental and should be insulated behind your own abstraction. ## What to watch - Whether CNCF accepts the Sandbox Kit specification and whether non-Docker runtimes implement it. - How the Kit schema evolves around credentials, network rules, volumes and composition. - Whether cloud sandbox session limits, regions and pricing change as the product matures. - How the experimental Sandboxes API and SDK stabilize for production automation. - Whether portable local-to-cloud agent state becomes a common feature across coding-agent infrastructure. ## Uncertainties - Docker’s claim of a consistent trust model across local and cloud execution is primarily vendor-described; independent production experience is still limited. - The API and SDK are explicitly experimental and may change. - OCI packaging makes Kits portable as artifacts, but practical runtime portability depends on other implementations adopting the specification. - The security value of a Kit depends on correct runtime enforcement and on the permissions teams choose to grant. ## Sources - [Introducing Cloud Sandboxes: Start on Your Laptop, Finish in the Cloud](https://www.docker.com/blog/introducing-cloud-sandboxes-start-on-your-laptop-finish-in-the-cloud/) — Docker · primary · 2026-09-24T00:00:00+12:00. Primary launch details, local-to-cloud workflow, pricing and supported agent environment. - [From Dockerfile to Kit: the Docker Sandboxes Kit Specification](https://www.docker.com/blog/docker-sandbox-kit-spec/) — Docker · primary · 2026-09-24T00:00:00+12:00. Primary explanation of the OCI-based Kit specification and authority model. - [Docker Sandboxes API and SDK](https://docs.docker.com/ai/sandboxes-api/) — Docker Docs · primary · 2026-09-24T00:00:00+12:00. Documents the experimental API/SDK and programmatic resource surface. - [Docker's new sandboxes aim to contain AI agents for real](https://www.theregister.com/ai-and-ml/2026/09/24/dockers-new-sandboxes-aim-to-contain-ai-agents-for-real/5298964) — The Register · independent_reporting · 2026-09-24T00:00:00+12:00. Independent conference coverage of the isolation demonstration, cloud launch and pricing.