AI Agent Isolation and Secure Execution

8/5/2026

This post argues that AI governance is fundamentally a developer experience problem, not just a security one. It posits that trust, built through clear boundaries and platform-embedded controls, is the key enabler for AI agent adoption at scale. The author emphasizes that when governance is part of the platform, developers can delegate tasks more confidently, leading to increased productivity and a better overall experience. This shifts the focus from restrictive controls to enabling freedom through well-defined operational parameters for AI agents.

8/3/2026

This post introduces audit logs for Docker AI Governance. These logs capture every policy decision made by AI agents, including allowed, denied, and held actions. The logs can be streamed directly to SIEM tools (e.g., Splunk, Dynatrace) via HTTPS and are also available in Docker Cloud with a 90-day retention and CSV export. The audit logs cover Docker Sandboxes policy decisions and sandbox session events, with plans to expand coverage to other sources like MCP Gateway enforcement decisions. The logs are metadata-only and do not contain sensitive prompt content or agent output.

8/3/2026

This post introduces and details Docker Sandbox Kits, a feature designed to improve the developer experience with sandboxed AI agents. It explains the problem of empty sandboxes requiring extensive setup, and how kits solve this by allowing developers to define required tools, network access, and credential management via a `spec.yaml` file. The post elaborates on kit types (sandbox vs. mixin), provides examples of kit configurations for installing tools, managing network access (allowed/denied domains, service domains), and handling credentials securely through proxying. It also discusses distribution mechanisms (local directories, Git URLs, OCI artifacts) and the benefits of kits for repeatability, reviewability, and shareability.

7/28/2026

This post details how Docker Sandboxes mitigate the risk of AI coding agents leaking credentials. It explains the attack vector where a poisoned npm package leverages AI CLIs with permission-bypass flags to scan for secrets. Docker Sandboxes address this by providing workspace-scoped filesystem access, preventing agents from seeing host credentials, and using proxy-injected secrets, ensuring sensitive information is not directly accessible within the isolated environment.

7/24/2026

This post details the integration of NanoClaw with Docker Sandboxes to provide secure execution for AI agents using MicroVM-based Docker Sandboxes for OS-level isolation. It also introduces the Docker MCP Gateway, an open-source component that acts as a chokepoint for agent tool calls, enforcing authentication, authorization, and logging before external system access.

7/20/2026

This post details a real-world incident where an AI coding agent with operator-level AWS credentials deleted a production environment, causing a 13-hour outage and significant financial loss. It highlights the dangers of AI agents inheriting full user permissions and the lack of a review loop, demonstrating the critical need for scoped-identity execution models to prevent such failures. The post connects these incidents to a broader trend of AI-linked outages at Amazon and the subsequent implementation of 'controlled friction' measures.

7/14/2026

This post details Docker's approach to securing AI agent execution at the runtime level, addressing the "lethal trifecta" by focusing on isolation, network policy, and trusted images. It highlights the use of microVMs for sandboxing agent sessions, providing boundaries for filesystem, network, and tools. The post also discusses governing the tool layer through an organization-managed catalog for MCP servers, enforcing default-deny policies. It emphasizes that agent trustworthiness is dependent on hardening what agents build on, isolating where they run, and controlling what they can reach, all managed from a single place.

7/8/2026

This post introduces the concept of 'your laptop is the new production environment' in the context of AI agents. It highlights the shift from AI assistants to AI agents that perform actions, emphasizing the resulting governance challenges. The post details how agents interact with systems locally and externally, and argues for runtime enforcement of controls rather than just prompt-based advice. It stresses the need for visibility and control over where agents run, what they access, and which tools they invoke, extending the scope of secure execution beyond isolated environments to the entire developer workflow.

7/1/2026

This post elaborates on the risks of AI agents executing code directly on host machines and introduces Docker SBX as a solution for isolation. It details the benefits of microVM-based protection over traditional containers for AI workloads, explains Docker SBX's approach to secure credential handling via proxy routing, and introduces Sandbox Kits as a mechanism for packaging and enforcing reusable environment configurations. The post further distinguishes between Mixin Kits (extending existing agents) and Agent Kits (defining complete agent environments), highlighting their roles in standardizing and distributing secure AI workflows.