I wanted to run a coding agent in a sandbox because if we are giving it full permission mode then it can be risky.
I came across Docker AI sandboxes which come with the built-in defaults needed to run coding agents. They support these coding agents out of the box.
I ran the following commands to set this up on macOS.
brew trust docker/tap
brew install docker/tap/sbx
sbx login
I needed to sign up with Docker, which I believe should be optional given these sandboxes are free to use even for commercial purposes. It’s a challenge in an enterprise setting, as we might need to get this approved before using it.
From the docs:
The sbx CLI is free to use, including for commercial work. Only organization governance requires a separate paid subscription.
After logging in, I changed to my coding-agents-workspace dir, which contains all the projects I am working on with the help of coding agents.
Then I launched the sandbox with Claude Code using this command: sbx run claude.
Some benefits I saw with this approach are:
- Quick setup: I could set this up and hit the road in under 5 minutes.
- Credential Injection Proxy: It injects creds on the fly, so the sandbox does not store credentials like API keys, auth tokens, SSH keys etc.
I followed this YouTube video to get up to speed.