Docker launches Cloud Sandboxes so coding agents finish in the cloud

24 Sep 2026 (ET): Docker introduced Cloud Sandboxes, putting the same microVM-based Docker Sandboxes on Docker-managed always-on compute so coding agents can run for hours without a laptop staying awake. Kits for Claude Code, Codex, Copilot, Antigravity, OpenCode, and Hermes are ready via `sbx --cloud run`.

SOFTWARE desk — a coding agent left on a long refactor or a test run for hours still has to live on a machine, and a laptop sleeps when the lid closes, slows on battery, and drops the network when you walk away. Docker’s announcement puts that same isolated microVM on computers Docker keeps running, so the work can continue after the laptop is shut, and one command moves the sandbox’s files between the two.

What the lede says the launch is. Run agents on your laptop, in the cloud, and move between them with one command, all safely. Earlier this year, Docker launched Docker Sandboxes: microVM environments where coding agents can work autonomously and safely. A microVM, here, is a very small virtual machine, with its own copy of an operating system. That gloss is this desk’s. The page prints microVM and does not define it. Earlier this year does not print a month. This filing does not invent one. Since then, the page says, agents have started taking on long-horizon work: tasks that run for hours, not minutes. Today, Docker is introducing Cloud Sandboxes: the same microVM-based sandbox, running on Docker-managed compute, with one command to move between them. Today is the post’s word, on a page posted 24 Sep 2026. This filing does not treat that word as a first-ever date the page does not print.

Why the hours matter, and whose laptop that is. The most important change in coding agents over the past year, the page says, is that they can work for much longer. Tasks that used to need a developer checking in every few minutes, a large refactor, a dependency migration, or a test suite that takes an hour, you can now hand off and review when they finish. A refactor is a rewrite of code that is supposed to keep doing the same job. A dependency migration is a move from one library the program relies on to another. A test suite is the set of checks that say whether the program still works. Those glosses are this desk’s. When agents worked in short bursts, the question was whether the model could hold a task together. Now that they work in hours, the question is where those hours happen. A laptop is built around a person. It sleeps when the lid closes, slows down on battery, and disconnects when you move. None of that matters for a task that takes thirty seconds. All of it matters for a task that takes all night. Thirty seconds, and all night, are the post’s clocks. They are not a timer this desk held.

The two questions, and what stays isolated. Docker built Docker Sandboxes to answer whether it is safe to run an agent unattended. In those sandboxes, agents run in a microVM with its own kernel and Docker daemon, isolated from the machine, so they can work on their own while files, network, and secrets stay protected if an agent steps out of line. A kernel is the core of the operating system on that small machine. A Docker daemon is the program on that machine that runs containers, the packaged programs. Those glosses are this desk’s. The page prints both words. Cloud Sandboxes answer the second question the page prints: how do I run a dozen agents at once, for five, ten, or 21 hours each, without watching any of them? A dozen, five, ten, and 21 are the page’s examples. They are not a count this desk ran. Cloud Sandboxes is the same microVM, on Docker-managed compute. The isolation model is identical. The CLI is identical. CLI means the command-line tool, the commands you type. That gloss is this desk’s. What changes is that the machines underneath are always on, and there are as many of them as you need. Always on, and as many as you need, are the page’s claims. This desk did not count the machines.

What the page says a person can do with that. Close the laptop and keep the work going: start an agent in the cloud before you leave for the day, disconnect, and review what it did in the morning. Start on the laptop and move to the cloud when the task outgrows it: work on the code in front of you, then hand the long tasks and the loops to a background agent. The command the page prints is sbx move my-project --to cloud. A move captures the sandbox’s filesystem, the files inside that sandbox, and recreates it on the other side, so the work carries over. The page says this works in both directions. The block it prints is the move to the cloud. It does not print a --to local line in that block. Do not invent the reverse command as a line the page typed. Run 100 tasks in parallel with nothing to provision. Docker runs the compute. Each one gets its own microVM, its own secrets, and its own network policy. 100 is the page’s figure. This desk did not start 100 tasks. Try things cheaply: run a pre-built agent for an hour to test an idea, then spin it down.

The three things an unattended agent needs, and the kits that are ready. The page says an agent doing long-horizon work without you needs a way to start with nothing to install, tools to do the job, and limits on what it can reach. Cloud Sandboxes ship with all three. You can spin them up and manage them from the command line or from the web console. A kit is a pre-configured, pre-built sandbox for an agent. Ready today, the page says, including Claude Code, Codex, Copilot, Antigravity, Open Code and Hermes. Or add your own. Open Code is two words on the page. The prose example is sbx –cloud run codex, and the mark before cloud in that sentence is an en dash, not two hyphens. The terminal block later on the page prints sbx --cloud run claude with two hyphens. Do not collapse those two spellings into one line the page did not print twice. The still’s labels are lowercase: claude, codex, copilot, antigravity, opencode, and hermes-agent. opencode is one word on the still. Hermes on the page, hermes-agent on the still. Those are the two surfaces. Do not file them as a second product list.

MCP, secrets, and the limits. Connect the MCP servers the agents need, Jira, Linear, Grafana, incident.io, or any streamable HTTP endpoint, once, and the agents can reach them through a single gateway whether they are in the cloud, on the laptop, or in another client such as the ChatGPT desktop app. MCP is the letters the page prints. Model Context Protocol, the usual name for that plug, is this desk’s gloss. The page does not expand the letters. A streamable HTTP endpoint is a web address that can keep sending data, not only answer once. That gloss is this desk’s. Jira and Linear are trackers for work. Grafana is a screen for metrics. incident.io is a tool for outages. Those glosses are this desk’s. The page prints the names. Secrets: store a key or a token once. The Cloud Sandboxes proxy injects it on each request, so the agent does not see the actual secret. A proxy, here, is a go-between that adds the secret as the request goes out. A prompt injection is a trick that tries to make the agent misuse something it can see. Those glosses are this desk’s. The page says prompt injections cannot touch secrets the agents never had. Policies: set network policies on which endpoints agents can reach, defined once. An endpoint, here, is an address the agent is allowed to open. Centralized governance is coming soon for enterprises through Docker AI Governance. Coming soon means the page does not describe it as available today. The link on the page is https://www.docker.com/products/ai-governance/. This desk did not open a governance console.

Why the page says it is one sandbox in two places, and whose survey that is not. Docker says it could have built Cloud Sandboxes as a separate product with its own commands. It did not, because how much you can trust the agent should not depend on where it is running. “As far as we know, no other agent sandbox works this way” is the page’s sentence. It is not a survey this desk ran. The page’s answer is one isolation model on both surfaces, the laptop and the cloud, and one command to move. These are not two tiers of one product. Interactive work belongs on the laptop. Work that takes hours belongs in the cloud. Most developers need both, the page says, and now you do not have to pick. Most developers is the page’s claim. This desk did not poll them.

What the meter charges, and what it says is free. Cloud Sandboxes are pay-as-you-go. The page meters compute by the second, and nothing else. A paused sandbox costs nothing. Volumes, egress, and hosting public images and Kits are free. A volume, here, is stored disk. Egress is data leaving the sandbox. Those glosses are this desk’s. You can bring your own model key and keep your existing provider for inference. Inference, here, is the model’s answers. The page’s point is that those answers stay on the bill of the model provider you already use, not on this compute table. That gloss is this desk’s. The table: Micro is 1 vCPU, 2 GiB, $0.07 an hour. Small, marked default, is 2 vCPUs, 4 GiB, $0.14. Medium is 4 vCPUs, 8 GiB, $0.28. Large is 8 vCPUs, 16 GiB, $0.56. XL is 16 vCPUs, 32 GiB, $1.12. A vCPU is a virtual processor, a slice of a chip assigned to the sandbox. A GiB is a gibibyte of memory, a bit more than a billion bytes. Those glosses are this desk’s. $0.07 an hour is 7 cents for a full hour of the smallest size. $1.12 an hour is a dollar and twelve cents for the largest. Because the page meters by the second, a run that stops early is not described as a full hour’s charge. Half of 7 cents is 3.5 cents. That half-hour Micro figure is this desk’s translation of the rate. It is not a second price printed on the page. Sandboxes run for one hour by default and up to 24 hours per session. The 21-hour example in the dozen-agents sentence is under that 24-hour cap. Do not collapse 21 and 24 into one number. For a limited time, new accounts get $250 in free Cloud Sandboxes credit. The claim link is https://www.docker.com/c/sbx-promo/. Limited time does not print an end date. $250 is the page’s credit. This desk did not claim it, and it did not receive a bill.

How a person starts one, and what the page says you need. From the browser: sign in to the web console, choose a kit, and click Run. The web console link on the page is https://agentic-platform.docker.com/. From the terminal, the page prints three lines: brew install docker/tap/sbx, then sbx login, then sbx --cloud run claude. You need sbx 0.45.1 or later. sbx is the command-line tool. That gloss is this desk’s. The version on the page links to https://github.com/docker/sbx-releases/releases. You also need the pay-as-you-go plan, available on Docker Personal and Pro accounts. The page names those two account types and does not print a monthly seat price beside them. Docker Sandboxes on the laptop remain free and standalone, with no Docker Desktop required. Local and cloud sandboxes keep separate secrets, templates, and network policies. The page says read the differences in the docs before you move a local workflow. This desk did not open that docs page.

Who wrote it. Timir Karia is Sr. Principal Product Manager at Docker. Srini Sekaran is Principal Product Marketing Manager for AI at Docker. The about line says he is Principal PMM for AI at Docker, focused on Docker AI Governance, Docker Sandboxes, and the future of agent infrastructure and developer workflows. PMM is product marketing manager. That gloss is this desk’s. The contributor pages are https://www.docker.com/contributors/timir-karia/ and https://www.docker.com/contributors/srini-sekaran/. This desk did not interview them.

What the card shows, and what the post’s prose list does not print. The card is the Cloud Sandboxes kit hub from the post, the image whose file name is Screenshot-2026-09-23-at-12.01.19-PM-2320x906.png. The still shows Run cards for claude, codex, copilot, antigravity, opencode, and hermes-agent, each with an sbx --cloud run command. Those labels are the still’s. The prose list is Claude Code, Codex, Copilot, Antigravity, Open Code and Hermes. The file name includes 2026-09-23 and 12.01.19 PM. That is the file name. It is not the Posted Sep 24, 2026 line, and it is not a date this desk painted on the card. The schema primary image on the page is https://www.docker.com/app/uploads/2025/03/image.png, 1300 by 1300. This filing does not use that image. The card has no desk date text.

Same-day Docker pages that are not this post’s price table. A second Docker blog the same day, “Manufacturing Trust for AI Agents,” Posted Sep 24, 2026, by Deanna Sparks, says Docker President Mark Cavage announced Cloud Sandboxes at WeAreDevelopers North America. That page says the same microVM isolation moves to Docker-managed cloud compute, that a person can start locally and move the work with one command so it continues after the laptop closes, that tasks can run in parallel without the person provisioning the machines, and that Cloud Sandboxes are available today with pay-as-you-go pricing. It does not print the hourly table, the kit names, sbx 0.45.1, or the $250 credit. It also says the next generation of Docker Sandbox Kits is built as standard OCI images, and that Docker has committed to submitting the Kits specification to the CNCF. OCI, the Open Container Initiative, is the format container images already use. CNCF is the Cloud Native Computing Foundation. The keynote page calls CNCF the open source, vendor-neutral hub of cloud-native computing. Those lines are that page’s. The Cloud Sandboxes post also lists two other 24 Sep related posts, and only the blurbs: Christian Dupuis, “From Dockerfile to Kit,” on Sandbox Kit Specification v3 as a pinnable OCI image, and Eli Aleyner and Srini Sekaran, “Docker and CNCF partner on an open spec for agent permissions.” Those blurbs are on the Cloud Sandboxes page. This desk did not treat them as the kit list or the prices.

Plain English for the rest of the card. A microVM is a very small virtual machine. A kernel is the core of its operating system. A Docker daemon runs containers on it. A kit is a sandbox that already has a coding agent set up. Claude Code, Codex, Copilot, Antigravity, Open Code, and Hermes are the names on the post. opencode and hermes-agent are the still’s labels. sbx is the command. sbx move my-project --to cloud copies the sandbox’s files to the cloud. The page says the move works both ways and prints the cloud direction. sbx --cloud run claude is the terminal example, with two hyphens. The prose example for Codex uses an en dash. MCP is the plug for tools such as Jira. The secret proxy adds a key on the way out so the agent never sees it. A network policy is the list of addresses the agent may open. Docker AI Governance is described as coming soon, not as on today. Micro at $0.07 an hour is 7 cents an hour for 1 virtual processor and 2 GiB of memory. Small, the default, is 14 cents an hour. XL is $1.12 an hour. A paused sandbox costs nothing. Volumes, egress, and public kits are free. The model key stays with the model provider. One hour is the default session. 24 hours is the cap. 21 hours is an example under that cap. $250 is a limited-time credit for new accounts, with no end date printed. sbx 0.45.1 is the version the page requires. Personal and Pro are the account types. Local sandboxes stay free, with no Docker Desktop required. Local and cloud keep separate secrets. 9:00 a.m. Pacific is 12:00 p.m. Eastern and 4:00 p.m. UTC. Timir Karia and Srini Sekaran wrote the post. This filing is the 24 Sep announcement.

PRIMARY here: Docker’s 24 Sep 2026 blog, “Introducing Cloud Sandboxes: Start on Your Laptop, Finish in the Cloud,” visible line Posted Sep 24, 2026, schema datePublished 2026-09-24T09:00:00-07:00, by Timir Karia and Srini Sekaran — Tier A PRIMARY, the company’s own announcement. STATUS PRIMARY. The earlier-this-year Docker Sandboxes sentence, the hours-not-minutes sentence, the laptop-sleeps sentence, the kernel and Docker daemon sentence, the dozen agents for five, ten, or 21 hours, the identical isolation and CLI, the always-on sentence, the move command, both directions, 100 parallel tasks, the one-hour cheap try, the three needs, the kit list including Open Code and Hermes, the en-dash Codex example, the two-hyphen Claude terminal block, the MCP gateway, the secret proxy, the network policies, Docker AI Governance as coming soon, the pay-as-you-go table from $0.07 to $1.12, paused costs nothing, volumes egress and public kits free, bring your own model key, one hour by default and up to 24 hours, the $250 new-account credit, sbx 0.45.1, Personal and Pro, local sandboxes free with no Docker Desktop, and separate local and cloud secrets are that post’s. The still’s opencode and hermes-agent labels are the screenshot’s. The 23 Sep file name is the screenshot’s file name. The Mark Cavage keynote lines, the OCI kits, and the CNCF commitment are the same-day keynote page’s. The two related-post blurbs are blurbs on this page. NOT claimed: that this desk started a sandbox, that earlier this year has a date, that a dozen or 100 was counted here, that no other sandbox was surveyed, that 3.5 cents is a printed price, an end date on the $250 credit, that coming soon has shipped, that Open Code and opencode were printed as the same string, a login, or a bill. The card is the kit hub. Distinct from the already-filed autonomyai-discover-mode, strada-browser-automation, and dataiku-agent-management.