Run AI Agents in GitHub Actions with Docker Sandboxes | Docker

This post details the integration of Docker Sandboxes (`docker-sbx`) with GitHub Agentic Workflows, enabling AI agents to run within isolated microVMs in CI/CD pipelines. It explains how `gh-aw compile` transforms Markdown workflows into GitHub Actions, leveraging `docker-sbx` as an agent runtime. The post highlights the isolation boundary provided by microVMs, each with its own kernel, filesystem, and private Docker daemon, allowing agents to run Testcontainers locally without compromising the host. A practical example demonstrates an agent fixing a bug in a Java application within this setup, with strict controls on file access and network exposure. It also provides instructions for setting up and running the workflow locally and on GitHub-hosted runners, and introduces Docker AI Governance for organizational policy enforcement.