Sam Witteveen · 2026-08-19 · notable
Sam Witteveen — 'Docker Sandboxes - Building Safe Agents'
Sam Witteveen's new video covers Docker Sandboxes, which run AI coding agents inside isolated microVMs. Each sandbox gets its own Docker daemon, filesystem and network, and is driven by a free sbx command-line tool.
A walkthrough of Docker Sandboxes, the microVM isolation layer for coding agents that would otherwise run loose on your machine.
What is it?
Docker Sandboxes, the subject of Sam Witteveen's new video, run AI coding agents in isolated microVM sandboxes. Each sandbox carries its own Docker daemon, filesystem and network stack, so an agent can build containers and rewrite files without touching the host. The `sbx` command-line tool manages them and is free to use, including for commercial work.
How does it work?
The isolation boundary is a microVM rather than a plain container, which is a harder wall for a misbehaving agent to cross. Because the sandbox ships its own Docker daemon, an agent inside it can still build and run images normally. Starting a session is one command from a project directory — `sbx run claude` launches Claude inside the sandbox.
Why does it matter?
Coding agents are usually handed a shell on the developer's real machine, which makes an unwanted `rm` or a poisoned dependency a host-level problem. Putting each agent in a disposable microVM with its own network keeps the blast radius inside the sandbox, and Sam Witteveen's video is aimed at engineers deciding whether that trade is worth the setup.
Who is it for?
engineers running coding agents locally
Try it
sbx run claude