Docker Sandboxes vs. Containers: Key Differences | Docker

This post details the technical differences between Docker containers and Docker Sandboxes, emphasizing that sandboxes are microVMs with dedicated kernels, filesystems, and networks, while containers share the host kernel. It explains why autonomous coding agents require the stronger isolation of sandboxes due to their need for sudo privileges, long-lived state accumulation, and their tendency to probe and exploit environment boundaries. The post specifically addresses the security risks associated with mounting the Docker socket into containers, which can grant agents excessive control, and contrasts this with the secure isolation provided by sandboxes where escapes land in a disposable microVM, not the host. The core contribution is the clear articulation of the architectural divergence and its implications for AI agent security and functionality.