Executive Overview & Architectural Significance
The software development landscape is undergoing a fundamental shift from short-burst, reactive coding assistance to long-horizon, autonomous agent tasks. While earlier iterations of AI-driven tools excelled at localized operations lasting mere seconds, modern engineering workflows increasingly demand multi-hour refactors, extensive dependency migrations, and prolonged test suite executions. However, executing these intensive workloads directly on local developer infrastructure introduces severe bottlenecks: local machines are inherently constrained by thermal limits, battery preservation policies, sleep cycles, and network disconnects. Furthermore, running autonomous routines on unmanaged hardware poses significant safety risks regarding local file system exposure, secret leakage, and unrestricted network access.
To bridge this architectural gap, Docker is introducing Cloud Sandboxes in the latest release. Building upon the foundational microVM isolation model launched earlier this year—where individual agents operate safely within an isolated kernel and localized Docker daemon—this update extends that robust security boundary to Docker-managed cloud compute. By providing a unified abstraction layer that seamlessly spans local hardware and remote cloud environments, Docker enables developers to execute complex, unattended agent operations at scale. This release establishes a consistent security posture, unified tooling, and zero-provisioning overhead, ensuring that developers can transition seamlessly between interactive local iteration and continuous, asynchronous cloud-based execution without compromising on system integrity or operational complexity.
Core Enhancements & Developer Ergonomics
The core architectural achievement of this release is the unification of the local and cloud sandbox lifecycle through a single, consistent Command Line Interface (CLI) and execution model. Developers can now initiate agent workflows locally for immediate iteration and swiftly transition heavy background tasks to the cloud using intuitive commands like sbx move my-project --to cloud. This command captures the complete filesystem state of the active microVM and transparently recreates it on the remote infrastructure, maintaining complete state continuity in both directions. This removes the friction typically associated with hybrid development environments, allowing workloads to scale dynamically based on task duration and resource requirements.
Beyond basic orchestration, the release introduces a comprehensive ecosystem designed specifically for autonomous agents: Kits, Model Context Protocol (MCP) gateways, proxy-injected secrets, and centralized networking policies. Kits provide pre-configured, pre-built microVM environments optimized for popular coding agents such as Claude Code, Codex, Copilot, Antigravity, Open Code, and Hermes. The MCP integration allows centralized connection management for enterprise tools like Jira, Linear, and Grafana, which are securely exposed to agents via a unified gateway across local and cloud surfaces. Crucially, sensitive keys and tokens are never exposed directly to the container runtime; instead, a proxy injects secrets per request, neutralizing potential prompt injection vectors. Finally, granular network policies ensure that agents remain strictly sandboxed, with centralized governance capabilities forthcoming via Docker AI Governance.
Architectural Comparison Matrix
| Feature | Previous Baseline (Local Sandboxes) | introducing-cloud-sandboxes-star (Cloud Sandboxes) |
|---|---|---|
| Latency (Lifecycle Startup) | Near-instant local microVM spin-up | Optimized cloud container instantiation with second-level metering |
| Memory Allocation | Constrained by local host physical RAM | Scalable tiers ranging from Micro (2 GiB) upward |
| APIs & Integration | Local Docker daemon & isolated file paths | Unified CLI (sbx), web console, MCP gateway, proxy secrets |
| Execution Horizon | Limited by local laptop power & active state | Continuous, 24/7 background execution across multiple nodes |
Breaking Changes & Migration Caveats
This release is fully backwards-compatible with previous local Docker Sandbox configurations. Because Cloud Sandboxes share the exact same underlying microVM architecture and isolation model as the initial local release, existing scripts, local configurations, and tooling definitions will continue to function without modification. There are no breaking changes introduced to the core CLI command structure; rather, cloud capabilities are introduced additively. Developers upgrading to this version do not need to rewrite their initialization routines, though they should review network policies and MCP server configurations if transitioning local workflows to the new Docker-managed cloud infrastructure.
Step-by-Step Upgrade Guide
Transitioning from local-only agent execution to hybrid cloud sandboxes requires minimal configuration. Follow these three steps to migrate an active local agent task to Docker-managed cloud compute:
- Verify and Update the CLI: Ensure your development environment is running the latest toolchain supporting the
sbxcommand. - Initialize or Move Your Workspace: To push an active local sandbox containing your long-running agent task to the cloud, execute the migration command:
sbx move my-project --to cloud - Deploy with a Pre-configured Kit: Alternatively, spin up a dedicated cloud agent instance directly using a specific agent kit:
sbx --cloud run codex