Docker is launching Cloud Sandboxes, which allow AI agents to run in isolated microVMs in the cloud instead of on a developer’s laptop. At the same time, the company is releasing a new generation of Kits, which are now built as standard OCI images. Both are available starting today.
With Cloud Sandboxes, agentic workloads can continue to run after a developer shuts down their machine. Execution moves to Docker-managed infrastructure, with the same microVM isolation and policies as the local version Docker introduced earlier this year.
This microVM approach was a deliberate choice. Each sandbox gets its own kernel and Docker daemon, plus separate network, workspace, and credential layers. Local sandboxes require hypervisor support; in the cloud, that requirement is eliminated.
Developers write their commands once and run them locally or in the cloud, using the same CLI and the same trust model. According to Docker, sandboxes boot up within a few hundred milliseconds, with secrets, policies, MCP gateways, and agent configuration already built in. Compute capacity scales from 1 to 16 vCPUs.
“Modern agentic workflows necessitate a fundamentally different approach to isolation,” says Mark Cavage, President at Docker. According to him, containers aren’t designed for the level of isolation AI agents require.
Kits as OCI images
The second announcement centers on Kits, Docker’s open specification for packaging an agent, its tools, and the rules governing what it can access, into a single artifact. These Kits are now standard OCI images, the same format underlying every container. Access rules are embedded within the Kit itself.
Docker has committed to submitting the Kits specification to the Cloud Native Computing Foundation. Cloud Sandboxes are available immediately, and the new Kits are available via Docker Hub and GitHub.
Tip: NanoClaw integrates with Docker to make AI agents more reliable