Docker returns to its coding-agent series with an argument shaped like a CI problem: no layer between the agent and the host

Short summary

Docker's Coding Agent Horror Stories series argues that AI coding agents on developer laptops run with full filesystem and credential access with no sandbox in between — the same known-bad pattern as an unisolated CI runner. The post compares three isolation approaches: containers (cheapest, shared kernel), microVMs (stronger boundary, higher overhead), and per-task sandboxes (strictest, most friction). Credential inheritance remains the hardest problem: a sandbox with a long-lived cloud key exported into it is just decoration.

• •AI coding agents inherit developer credentials and filesystem access with no sandbox by default
• •Three isolation tiers: containers, microVMs, and per-task sandboxes — each with distinct trade-offs
• •Credential inheritance is the residual risk: short-lived task-scoped tokens are the honest fix

Generated with AI, which can make mistakes.