Docker Sandboxes Lifecycle Agent Skill

Docker Sandboxes: Local Lifecycle & Workspace Isolation

Overview

Docker Sandboxes (sbx) runs an AI coding agent inside an isolated microVM with

its own filesystem, network, and Docker daemon. This skill owns the local

sandbox lifecycle — creating, reattaching to, listing, stopping, and removing

sandboxes — and the workspace isolation choice (direct bind mount vs.

--clone). It does not cover network policy, credentials, sbxenv.yaml, or

kit authoring — see Related skills.

When to use this skill

Activate this skill when:

• The user wants to start, reattach to, stop, or remove a local sbx sandbox.
• The user wants an agent to work on a repository without giving it a

writable bind mount of the host working tree (--clone).

• The user wants extra read-only (or write-restricted) workspaces mounted

alongside the primary one.

• The user is copying files between host and sandbox, publishing a sandbox

port, or running an ad-hoc command inside a sandbox (sbx exec).

• The user wants to clean up stopped sandboxes (sbx prune) or remove a

specific one (sbx rm), with the destructive consequences understood.

Do not use this skill when

Do not use this skill when:

• The task is running docker agent run --sandbox or managing its

docker agent sandbox allowlist — use docker-agent-run. If the CLI

is unclear, establish whether the user runs Docker Agent or standalone

sbx before choosing commands.

• The task is about what a sandbox can reach on the network or which

credentials it uses — use docker-sandboxes-network-credentials.

• The task is authoring or running a declarative sbxenv.yaml file — use

docker-sandboxes-env.

• The task is authoring, packaging, signing, or composing a kit spec.yaml

— use docker-sandboxes-kits.

• The task is about sbx --cloud (Docker Cloud Sandboxes) — out of scope for

this skill set, which covers the local daemon only.

Core guidance

Creating vs. running

• Use sbx run AGENT [PATH...] to create-if-needed and attach in one

step. Use sbx create AGENT [PATH...] to create without attaching, then

sbx run --name SANDBOX to attach later. Pass --detached/-d to sbx run

to print the sandbox ID and exit without an interactive session.

  sbx run shell                  # create (if needed) and attach, cwd mounted
  sbx create shell .             # create only, cwd mounted, do not attach
  sbx run --name my-sandbox       # reattach later

• AGENT is a built-in name (claude, codex, cursor, devin,

docker-agent, gemini, opencode, shell) or a sandbox kit reference

(local directory, ZIP, git, or OCI). A relative local kit reference MUST be

an explicit path (./my-kit, a parent-relative .zip path) — a bare my-kit is read as

an agent/sandbox name, never a directory beside the cwd.

• Omitting the path is not the same for every subcommand. sbx run claude

with no path mounts the current directory. sbx create claude with no

path mounts nothing at all — the agent then works only in the

container's own filesystem. Always pass a path explicitly with sbx create

if you intend to give the agent a workspace.

• **Prefer --name to reattach; a bare positional name still works but is

deprecated.** sbx run --name NAME (agent positional optional, read from

the sandbox's own spec) is the recommended form. A bare sbx run NAME —

a positional that is neither a known agent nor an explicit kit reference —

is still accepted as a legacy re-attach shorthand, but prints a

deprecation warning ("sbx run NAME is deprecated; use

sbx run --name NAME instead") and may be removed in a future release.

Always write --name explicitly rather than relying on the legacy form.

  sbx run --name existing-sandbox                 # reattach, agent read from spec
  sbx run claude --name existing-sandbox          # reattach, verify expected agent

Workspace isolation: bind mount vs. --clone

• Default (bind mount): the workspace path is mounted read/write inside

the sandbox at the same path as on the host. The agent can write directly

to your working tree.

• --clone (creation-time only): the agent runs against a private

in-container clone of the host Git repository. The host repo is mounted

read-only; the agent's commits land in the in-container clone and are

reachable from the host via a sandbox-<name> git remote — fetch or pull

from it to bring commits back.

  sbx create --clone --name demo claude .
  # on the host, later:
  git fetch sandbox-demo

• --clone has real preconditions, checked at creation time, and fails

loudly if any is unmet:

• an explicit PATH must be given (there must be a workspace to clone

from);

• that path must be inside a Git repository;
• it must NOT be a Git worktree (the in-container clone cannot follow a

worktree's .git pointer out to a common dir elsewhere);

• its .git must be a real directory, not a file (a submodule or a

--separate-git-dir setup points .git elsewhere, which the read-only

source mount would not include).

• **--clone on sbx run when reattaching is a no-op ONLY on a sandbox

already created in clone mode** — it re-validates nothing new and simply

keeps running the existing in-container clone. Passing --clone while

reattaching to a sandbox that was created without it (a plain

bind-mounted sandbox) is not a silent no-op: it fails with an error

telling you to recreate the sandbox with sbx create --clone .... Neither

form can convert an existing sandbox's mode after creation.

• **Removing or pruning a clone-mode sandbox permanently discards every

commit the agent made that was never fetched back to the host** — the

in-container clone lives on the sandbox's own filesystem and is deleted

with it. Before removing a clone-mode sandbox, fetch its work first:

  git fetch sandbox-demo

Fetching populates two refspecs: the ordinary refs/remotes/sandbox-demo/*

(deleted along with the remote when the sandbox is removed) and a survivor

copy at refs/sandboxes/demo/* (outside the remote namespace, so it is

not deleted when the remote goes). Recover a branch from the survivor

copy after removal with:

  git branch <local-name> refs/sandboxes/demo/<branch>

sbx rm/sbx prune print this warning automatically for any clone-mode

sandbox they are about to remove; read it before confirming, don't

suppress it with --force out of habit.

• Additional workspaces are extra positional paths after the first. Append

:ro to mount one read-only. :ro blocks writes, not reads — the

sandbox can still read every file under a :ro mount; it is not a way to

hide sensitive content, only to stop the sandbox from modifying it. A

read-only argument may name a single file rather than a directory, holding

just that one path out of reach for writes inside a workspace the sandbox

can otherwise write.

  sbx run claude . /path/to/docs:ro

Never mount a secrets/credentials file this way (:ro or otherwise) —

a read-only mount still lets the sandbox (and, through it, the proxy-less

agent process) read the secret in the clear. Use the credential store

instead; see docker-sandboxes-network-credentials.

Reattaching, stopping, and removing

• sbx ls lists sandboxes with agent, status, published ports, and

workspace (--json, -q/--quiet for scripting).

• sbx stop SANDBOX [SANDBOX...] stops without removing; state is retained

and the sandbox restarts with sbx run --name.

• sbx rm [SANDBOX...] [--all] [--force] removes sandboxes, their

containers, Git worktrees, state, and sandbox-scoped secrets. **This

cannot be undone**, and for a clone-mode sandbox it discards every

unfetched commit (see above). Only use --force when you have already

reviewed what will be destroyed and consented — for scripted teardown of

resources this session itself created and uniquely named, not as a

default habit.

• sbx prune [--dry-run] [--filter until=VALUE] [--force] removes only

stopped sandboxes — a running sandbox is never touched — but this is

still a destructive, irreversible bulk removal: every matching stopped

sandbox's state, secrets, and (for clone-mode sandboxes) any unfetched

commits are gone. Always preview with --dry-run first and read the

clone-commit warning it prints before removing for real; do not pass

--force as a default.

• Current source flag is --filter until=VALUE, not since=. VALUE

may be an RFC 3339 timestamp, a Unix timestamp, or a Go duration

relative to now (e.g. until=168h keeps anything stopped within the

last week — i.e. prunes what stopped *before* that point). **This is a

source-only behavior at the pinned commit that differs from some

installed builds**: an older installed sbx may still advertise

--filter since=DURATION as a legacy alias; prefer until= and treat

since= as legacy-only if your installed --help output does not show

until=.

  sbx prune --dry-run --filter until=168h
  # after reviewing the dry-run output and any clone-commit warnings:
  sbx prune --filter until=168h

Copying files and running ad-hoc commands

• sbx cp SRC DST copies between host and sandbox; exactly one side must be

SANDBOX:PATH. Copying between two sandboxes is not supported.

  sbx cp ./config.json my-sandbox:/home/agent/
  sbx cp my-sandbox:/home/agent/output.log ./

• sbx exec [flags] SANDBOX COMMAND [ARG...] runs a command in a sandbox

(starting it first if stopped); flags mirror docker exec (-it, -d,

-u, -w, -e, --env-file, --privileged).

  sbx exec -it my-sandbox bash
  sbx exec -u root my-sandbox apt-get update

• sbx ports SANDBOX [--publish SPEC] [--unpublish SPEC] manages published

ports after creation; -p/--publish on sbx create/sbx run only takes

effect when the sandbox is created, not on reattach.

Sizing and naming

• --cpus (0 = auto: all host CPUs) and --memory/-m (default 50% of

host memory, clamped 512 MiB–32 GiB) are create-time-only knobs.

• --name sets the sandbox name (default <agent>-<workdir>); at least two

characters, starting with a letter or number, letters/numbers/hyphens/

periods only, at most 63 ASCII characters, ending in a letter or number;

default is reserved.

Related skills

• For docker agent run --sandbox and docker agent sandbox commands,

use docker-agent-run.

• For network egress policy and service/registry credentials, use

docker-sandboxes-network-credentials.

• For declarative, checked-in sbxenv.yaml environments that wrap this same

create/run/rm lifecycle, use docker-sandboxes-env.

• For authoring or composing the kit spec.yaml an AGENT reference can

point to, use docker-sandboxes-kits.

References

• references/sources.md — provenance for every rule above (help captures, source paths, docs URLs).

Assets

• None.

Checks

• checks/verification.md — Verification runbook for sandbox lifecycle commands (unexecuted runbook; run manually with an isolated --app-name, never with --force except consented cleanup of the runbook's own uniquely-named test sandboxes).