Docker Sandboxes AI Agent Isolation Architecture and Hardening Guide

Vulnerability Key Information Summary Vulnerability Overview This page introduces the isolation mechanisms of Docker Sandboxes. The core component is the "Isolation layers," designed to protect the host system from risks associated with AI coding agents (such as Claude Code, Codex, Cursor, etc.) executing code, installing software packages, and running tools. Scope of Impact Hypervisor Isolation: Each sandbox runs in a lightweight microVM, preventing the agent from accessing the host kernel, file system, network, Docker engine, workspace, and external agents. Network Isolation: The sandbox possesses an isolated network, prohibiting direct communication with the host or other sandboxes. Outbound TCP traffic enforces network policies through a proxy, and DNS queries use an internal sandbox resolver that only forwards to policy-allowed targets. Docker Engine Isolation: An independent Docker engine runs within the sandbox, isolated from the host's Docker daemon, preventing the agent from accessing the host's Docker socket. Workspace Isolation: Supports three modes: - Mountless: The sandbox does not mount the host workspace; the agent operates within the default working directory of the sandbox template. - Direct mount: The host workspace is mounted to the sandbox in read-only mode. The agent can read and write workspace files but cannot access other host paths. - Clone mode: The agent operates within a private cloned repository, isolated from the host repository to prevent direct modifications to the host repository. Credential Isolation: Sensitive information, such as API keys, is stored on the host side. By intercepting outbound API requests and injecting authentication headers, agents within the sandbox cannot directly access the credentials. Remediation Use Mountless mode: Create an unmounted sandbox using , allowing the agent to work in the default working directory of the sandbox template. Use Direct mount mode: Mount the host workspace to the sandbox in read-only mode using . The agent can read and write workspace files but cannot access other host paths. Use Clone mode: Create a cloned repository using . The agent works within the private cloned repository, isolated from the host repository to prevent direct modifications to the host repository. Use Credential isolation: Store sensitive information, such as API keys, on the host side. By intercepting outbound API requests and injecting authentication headers, agents within the sandbox cannot directly access the credentials. POC Code or Exploitation Code

Goal Reached Thanks to every supporter — we hit 100%!

Docker Sandboxes AI Agent Isolation Architecture and Hardening Guide