Docker推出了Sandboxes产品，为AI代理提供隔离的沙箱运行环境[1]。该产品采用MicroVM技术实现硬安全边界，相比传统虚拟机提供更轻量的完全隔离[1]。
Docker Sandboxes支持多种主流AI编码代理，包括Claude Code、Gemini CLI、Copilot CLI、Codex、OpenCode和Kiro[1]。产品提供网络和文件系统控制、快速启动和拆除等功能[1]。
Docker AI Governance为企业用户提供集中管理能力，支持网络策略、文件系统控制和MCP治理[1]。在YOLO mode（使用--dangerously-skip-permissions）下，AI代理可获得完全自主权，但不会收到批准提示[1]。
Docker has introduced Sandboxes, a new product designed to provide isolated execution environments for artificial intelligence agents.[1] The platform leverages MicroVM technology to establish hard security boundaries, offering a lightweight alternative to traditional virtual machines while maintaining complete isolation.[1]
The service supports multiple leading AI coding agents, including Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro.[1] Docker Sandboxes provides granular control over network and file system access, enabling rapid startup and teardown of environments.[1] For users requiring maximum autonomy, the platform offers a YOLO mode (activated via the --dangerously-skip-permissions flag) that grants agents full operational authority without approval prompts.[1]
To address enterprise requirements, Docker has integrated AI Governance capabilities that centralize management across deployments.[1] This governance layer encompasses network policies, file system controls, and MCP governance functions,[1] allowing organizations to maintain security oversight while leveraging AI agent capabilities at scale.