{"id":5334,"date":"2026-11-06T03:31:57","date_gmt":"2026-11-06T03:31:57","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/11\/06\/docker-sandboxes-vs-containers-choosing-the-right-isolation-for-ai-agents\/"},"modified":"2026-11-06T03:31:57","modified_gmt":"2026-11-06T03:31:57","slug":"docker-sandboxes-vs-containers-choosing-the-right-isolation-for-ai-agents","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/11\/06\/docker-sandboxes-vs-containers-choosing-the-right-isolation-for-ai-agents\/","title":{"rendered":"Docker Sandboxes vs. Containers: Choosing the Right Isolation for AI Agents"},"content":{"rendered":"<p class=\"wp-block-paragraph\">If you\u2019ve used Docker for a while, \u201cDocker Sandboxes\u201d might read as \u201ca container with an AI agent inside.\u201d Containers have been the unit of nearly everything Docker ships for over a decade, and a sandbox might sound like one more way to package a workload.<\/p>\n<p class=\"wp-block-paragraph\">They\u2019re actually different technologies. A container is an isolated process that shares the host kernel with everything else on the machine. Docker Sandboxes are <a href=\"https:\/\/www.docker.com\/products\/docker-sandboxes\/vs-containers\/\" target=\"_blank\" rel=\"noreferrer noopener\">dedicated microVMs with their own Linux kernel<\/a>, filesystem, network, and Docker Engine, built for autonomous coding agents that need a whole development machine to work in. A sandbox can run containers, which is part of why the two are easy to conflate.<\/p>\n<p class=\"wp-block-paragraph\">In his <a href=\"https:\/\/www.docker.com\/blog\/manufacturing-trust-for-ai-agents-keynote\/\" target=\"_blank\" rel=\"noreferrer noopener\">WeAreDevelopers keynote<\/a>, Docker President Mark Cavage said containers are doing exactly the job they were designed to do, but we\u2019re asking them to do a different job.<\/p>\n<p class=\"wp-block-paragraph\">Containers were built to isolate applications, which they still do well. But a coding agent is an actor: it makes decisions and operates on your systems the way a developer uses a laptop. It clones repositories, installs packages, starts databases, builds images, and tries again for hours. It can also act on instructions from files, web pages, and tool output that nobody reviewed. <\/p>\n<p class=\"wp-block-paragraph\">That different job needs a different boundary, and where that boundary sits determines how far an agent\u2019s mistake can travel. This post covers how Docker Sandboxes and containers isolate workloads, what changes beyond the kernel, what a sandbox costs you in setup, and how to pick.<\/p>\n<div class=\"wp-block-ponyo-zeta organism toc-exclude\">\n<blockquote class=\"container\">\n<h2 class=\"wp-block-ponyo-heading text-lg\">\n        Key takeaways<br \/>\n    <\/h2>\n<ul class=\"wp-block-list\">\n<li>A container is an isolated process sharing the host kernel. Docker Sandboxes are microVMs with their own kernel, filesystem, network, and Docker Engine.<\/li>\n<li>Containers stay the right choice for packaged applications, CI jobs, and short-lived execution.<\/li>\n<li>Docker Sandboxes fit autonomous agents that need sudo, a private Docker Engine, long-lived state, and host-enforced network and credential controls.<\/li>\n<li>Containers can be part of an agent\u2019s containment, and a sandbox can run them. Sandbox the agent, containerize the application it works on.<\/li>\n<\/ul>\n<\/blockquote>\n<\/div>\n<h2 class=\"wp-block-heading\">What is a container?<\/h2>\n<p class=\"wp-block-paragraph\">A <a href=\"https:\/\/www.docker.com\/resources\/what-container\/?at_exp=DO105.A-DO106.B\" target=\"_blank\" rel=\"noreferrer noopener\">container<\/a> is a process, or a group of processes, running on the host with its own view of the filesystem, process tree, and network. Linux namespaces provide that view, and cgroups meter CPU, memory, and I\/O. Every container on the machine also shares the host kernel, which is why containers start quickly, pack densely, and carry so little overhead.<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=1652342098  fetchpriority=\"high\" decoding=\"async\" width=\"2320\" height=\"1218\" src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/11\/docker_sandboxes-vs-containers_110226_v1_DARK-2320x1218.jpg\" class=\"fade-in\" alt=\"Diagram of an agent running in a Linux container. The agent process, your app, and your database each run in their own container, all sharing one host kernel. A container escape lands on the host kernel, alongside every other container, with your files, credentials, network, and other processes beneath it.\" title=\"- docker sandboxes vs containers 110226 v1 DARK\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<\/p><p class=\"wp-block-paragraph\">This design has more than a decade of tooling behind it. Compose, Kubernetes, OCI registries, image scanners, and nearly every CI system treat the container as the common primitive. If the job is to run a service, execute a code snippet, process one request, or run an evaluation and disappear, a container is usually the obvious pick, and it will stay that way.<\/p>\n<div class=\"wp-block-ponyo-table\" data-highlighted-columns=\"null\" data-highlighted-rows=\"null\">\n<table class=\"responsive-table\">\n<tbody class=\"wp-block-ponyo-table-body\" data-highlighted-columns=\"[]\" data-highlighted-rows=\"[]\">\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">\u24d8\u00a0Containers share one kernel, even inside a VM. On macOS and Windows, Docker Desktop runs your Linux containers inside a virtual machine, which keeps them off your host operating system. Every container in that VM still shares its single kernel, so the isolation between one container and the next is unchanged.<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2 class=\"wp-block-heading\">What are Docker Sandboxes?<\/h2>\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Docker Sandboxes<\/a> run an AI coding agent inside a <a href=\"https:\/\/www.docker.com\/blog\/benefits-of-sandbox-environments\/\" target=\"_blank\" rel=\"noreferrer noopener\">microVM that has its own Linux kernel<\/a>, its own filesystem and network stack, and a private Docker Engine. The agent gets sudo inside the isolated environment. It can install packages, run services, build images, and bring up an entire Compose application without reaching the host Docker daemon, the host filesystem outside its workspace, or other sandboxes on the same machine.<\/p>\n<div class=\"wp-block-ponyo-image\">\n                <img data-opt-id=1792798385  fetchpriority=\"high\" decoding=\"async\" width=\"2320\" height=\"1218\" src=\"https:\/\/www.docker.com\/app\/uploads\/2026\/11\/docker_sandboxes-vs-containers_110226_v1-DARK-2-2320x1218.jpg\" class=\"fade-in\" alt=\"Diagram of an agent in a Docker Sandbox. The agent process, a private Docker Engine, and your app and database containers all run inside a microVM with its own guest kernel. Another agent runs in a separate microVM. A native hypervisor boundary sits between the microVMs and your machine, so a container escape lands in a disposable microVM, not on the host.\" title=\"- docker sandboxes vs containers 110226 v1 DARK 2\" \/>\n        <\/div>\n<p class=\"wp-block-paragraph\">\n<\/p><p class=\"wp-block-paragraph\">Getting one running takes a single command, using sbx, the Docker Sandboxes CLI:<\/p>\n<p class=\"wp-block-paragraph\"><code>sbx run claude<\/code><\/p>\n<p class=\"wp-block-paragraph\">That creates the sandbox and starts the agent. You can stop it, resume it, and come back to everything the agent installed until you remove the sandbox.<\/p>\n<h2 class=\"wp-block-heading\">Why do coding agents need a full machine?<\/h2>\n<p class=\"wp-block-paragraph\">Coding agents need a full machine because their sessions build up state over hours and they act on unvetted instructions. A container is built for a process with a known set of dependencies, and an agent\u2019s work doesn\u2019t fit that shape.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">An agent needs the authority of a whole machine and a boundary designed for one. The capabilities that make an agent useful, such as running code, installing packages, and reaching the network, are the same ones that wear at the walls around it. An agent probes the edges of its environment because the job requires <em>changing<\/em> that environment.<\/p>\n<h3 class=\"wp-block-heading\">Agents accumulate state for hours<\/h3>\n<p class=\"wp-block-paragraph\">A coding agent\u2019s session looks like a developer\u2019s afternoon. It clones a repository, installs packages, starts PostgreSQL, runs migrations, builds images, launches the app with Compose, reads the logs, changes the code, and tries again. That loop can run for hours, and each step depends on what the previous one left behind.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">A container is designed to be rebuilt from an image and a few explicit volumes. The packages, databases, and build output an agent creates outside those volumes are lost when the container is recreated. That\u2019s less than ideal for a session where every step builds on the last.<\/p>\n<div class=\"wp-block-ponyo-table\" data-highlighted-columns=\"null\" data-highlighted-rows=\"null\">\n<table class=\"responsive-table\">\n<tbody class=\"wp-block-ponyo-table-body\" data-highlighted-columns=\"[]\" data-highlighted-rows=\"[]\">\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/boat.dev\/blog\/containers-vs-vms\" rel=\"nofollow noopener\" target=\"_blank\">Box by ASCII<\/a> describes this distinction neatly: \u201cIt uses the sandbox the way a developer uses a laptop, so the sandbox has to behave like one.\u201d<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h3 class=\"wp-block-heading\">Agents act on untrusted instructions<\/h3>\n<p class=\"wp-block-paragraph\">The program deciding which command to run is probabilistic, and it can read instructions from many places at once, including source files, issue descriptions, web pages, package metadata, and MCP tool output. Some of that input is untrusted, and a <a href=\"https:\/\/www.docker.com\/blog\/coding-agent-horror-stories-the-command-you-already-approved\/\" target=\"_blank\" rel=\"noreferrer noopener\">malicious instruction planted in a README or a tool description<\/a> can steer the agent on purpose. The code it generates may also be wrong or actively hostile.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">We\u2019ve already seen an agent that <a href=\"https:\/\/www.docker.com\/blog\/coding-agent-horror-stories-the-agent-that-deleted-production\/\" target=\"_blank\" rel=\"noreferrer noopener\">deleted a production database<\/a> after misreading its task. Once the agent is <a href=\"https:\/\/www.docker.com\/blog\/what-is-yolo-mode\/\">running una<\/a><a href=\"https:\/\/www.docker.com\/blog\/what-is-yolo-mode\/\" target=\"_blank\" rel=\"noreferrer noopener\">t<\/a><a href=\"https:\/\/www.docker.com\/blog\/what-is-yolo-mode\/\">tended in YOLO mode<\/a>, there\u2019s no permission prompt left to catch it. A workload with that much authority and that little predictability needs a boundary designed for it.<\/p>\n<p class=\"wp-block-paragraph\">Put these facts together and you get the reason why we built Docker Sandboxes. An autonomous coding agent needs machine-shaped capabilities without access to everything on the developer\u2019s machine, which comes down to four things:<\/p>\n<ol class=\"wp-block-list\">\n<li><strong>Containment<\/strong>: a boundary the model can\u2019t rewrite<\/li>\n<li><strong>Control<\/strong>: observability into what the agent is doing and the ability to stop it<\/li>\n<li><strong>Choice<\/strong>: the freedom to swap agents, models, and tools without rebuilding the setup<\/li>\n<li><strong>Capacity<\/strong>: a setup other developers can reproduce and scale past one machine.\u00a0<\/li>\n<\/ol>\n<p class=\"wp-block-paragraph\">The next sections show what each looks like, starting with containment.<\/p>\n<h2 class=\"wp-block-heading\">Containment: How isolation differs between containers and Docker Sandboxes<\/h2>\n<p class=\"wp-block-paragraph\">The short version is that a container\u2019s boundary is the host kernel it shares, and Docker Sandboxes have a hypervisor boundary around a kernel the agent has to itself. That one difference decides how far a compromise can travel, and it also settles the awkward question of how an agent could get access to Docker.<\/p>\n<p class=\"wp-block-paragraph\">This is where containers and <em>containment<\/em> part ways. A container can be part of containment, and often should be, but containment covers the whole environment around the agent. It starts with a boundary the model can\u2019t rewrite, which is why Docker uses a microVM with its own kernel for autonomous agents.<\/p>\n<h3 class=\"wp-block-heading\">Shared kernel vs. dedicated kernel<\/h3>\n<p class=\"wp-block-paragraph\">A container\u2019s boundary is enforced by the kernel it shares, so escaping it requires a kernel exploit or a side-channel attack. Those aren\u2019t everyday finds. Past that bar, though, sits the entire host kernel, every other process on the machine, and <a href=\"https:\/\/www.docker.com\/blog\/coding-agent-horror-stories-the-29-million-secret-problem\/\" target=\"_blank\" rel=\"noreferrer noopener\">any credentials mounted alongside them<\/a>.<\/p>\n<div class=\"wp-block-ponyo-table\" data-highlighted-columns=\"null\" data-highlighted-rows=\"null\">\n<table class=\"responsive-table\">\n<tbody class=\"wp-block-ponyo-table-body\" data-highlighted-columns=\"[]\" data-highlighted-rows=\"[]\">\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">\u24d8\u00a0This scenario is specific to Linux environments. On Docker Desktop (macOS and Windows), the shared kernel is the Docker Desktop VM\u2019s kernel, not the host kernel, so an escape would land in that VM rather than the operating system.<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p class=\"wp-block-paragraph\">Docker Sandboxes give the agent its own kernel behind a hypervisor boundary. If an agent escapes its container, it lands in a disposable microVM, and the host stays out of reach. And you can delete the sandbox and start another. Each agent also gets its own microVM, so two agents running on the same machine can\u2019t reach each other\u2019s sandboxes either. However, the agent can still reach whatever you chose to share with it, including the workspace, allowed network destinations, MCP servers, and skills.<\/p>\n<h3 class=\"wp-block-heading\">The Docker socket problem<\/h3>\n<p class=\"wp-block-paragraph\">Mounting <code>\/var\/run\/docker.sock<\/code> into a container is the long-standing way to give it Docker access, and it turns up in Compose setups, CI pipelines, and observability tools. It also hands the container control of the host Docker daemon, which Docker <a href=\"https:\/\/docs.docker.com\/engine\/security\/#docker-daemon-attack-surface\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">limits to trusted users<\/a> because it can mount host paths and start privileged containers.<\/p>\n<p class=\"wp-block-paragraph\">An agent doesn\u2019t need an exploit to use that. Put one in a container started with the socket mounted, and it probes its surroundings, works out that it\u2019s in a container, and finds the hole in the configuration. In Mark\u2019s keynote demo, that was enough for an agent to <a href=\"https:\/\/www.youtube.com\/live\/G1tT3pwbsMM?si=v-hODxDMU7pDvjPZ&amp;t=55\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">reach a secrets file on the host<\/a> with no zero-day involved.<\/p>\n<p class=\"wp-block-paragraph\">The socket is one hole among several, and agents find them because probing their environment is part of the work. Docker-in-Docker, mounted credentials, and broad host mounts are others. Containers were built to isolate an application that behaves as configured. But an agent keeps testing that configuration, so if there\u2019s a gap, it\u2019s likely to find it.<\/p>\n<h3 class=\"wp-block-heading\">Where the microVM boundary goes<\/h3>\n<p class=\"wp-block-paragraph\">Docker Sandboxes put the missing boundary in the right place. The agent talks to a <a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/security\/isolation\/#docker-engine-isolation\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">private Docker Engine<\/a> inside the guest. It can build images, run Testcontainers, and start a whole Compose stack, and the host daemon and its socket stay outside the microVM the entire time. Containers keep doing what they do best, inside a boundary the agent can\u2019t widen.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Let\u2019s say you ask an agent running inside Docker Sandboxes to find a secrets file on the host. It\u2019ll find a Docker socket, <a href=\"https:\/\/www.youtube.com\/live\/G1tT3pwbsMM?si=v-hODxDMU7pDvjPZ&amp;t=55\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">try to use it to mount host paths and start privileged containers<\/a>, but won\u2019t reach the host. A microVM can give it a much stronger trust boundary than a container. The <a href=\"https:\/\/www.docker.com\/blog\/why-microvms-the-architecture-behind-docker-sandboxes\/\" target=\"_blank\" rel=\"noreferrer noopener\">architecture behind Docker Sandboxes<\/a> goes deeper on why a microVM was the right shape for this.<\/p>\n<h2 class=\"wp-block-heading\">Control: What you can see and stop beyond the kernel<\/h2>\n<p class=\"wp-block-paragraph\">Containment draws the boundary. <em>Control<\/em> is what you can see and stop inside it: what the agent is allowed to reach, and the ability to block it when it heads somewhere it shouldn\u2019t. In a sandbox, those controls are enforced by the host, outside the agent\u2019s reach, so the agent can\u2019t switch them off or reason its way around them. Outbound traffic, credentials, and organization-wide policy all work this way. Control also means knowing what the agent can still touch, because a microVM can\u2019t hide what you choose to share with it.<\/p>\n<div class=\"wp-block-ponyo-table\" data-highlighted-columns=\"null\" data-highlighted-rows=\"null\">\n<table class=\"responsive-table\">\n<tbody class=\"wp-block-ponyo-table-body\" data-highlighted-columns=\"[]\" data-highlighted-rows=\"[0]\">\n<tr class=\"wp-block-ponyo-table-header\">\n<th class=\"wp-block-ponyo-cell empty\">\n<p class=\"wp-block-paragraph\">\n<\/p><\/th>\n<th class=\"wp-block-ponyo-cell\" data-responsive-table-heading=\"Agent in a standard container\">\n<p class=\"wp-block-paragraph\">Agent in a standard container<\/p>\n<\/th>\n<th class=\"wp-block-ponyo-cell\" data-responsive-table-heading=\"Agent in Docker Sandboxes\">\n<p class=\"wp-block-paragraph\">Agent in Docker Sandboxes<\/p>\n<\/th>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><strong>Kernel<\/strong><\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Shares the host kernel<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Runs its own Linux kernel in a microVM<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><strong>Docker<\/strong><\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Needs the host socket or a nested daemon<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Uses a private Docker Engine inside the microVM<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><strong>Workspace<\/strong><\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Sees the host paths you mount<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Uses a direct read-write mount or an in-VM private clone<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><strong>Network<\/strong><\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Uses the container network and whatever controls its operator supplies<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Sends outbound traffic through a host proxy with deny-by-default policy<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><strong>Credentials<\/strong><\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Commonly receives environment variables, files, or mounted sockets<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Uses host-side credential injection for supported HTTP services<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><strong>State<\/strong><\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Usually rebuilt from an image and explicit volumes<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Keeps packages, images, containers, and agent history until sbx rm<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\"><strong>Orchestration<\/strong><\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Fits Compose, Kubernetes, and most CI systems<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Uses the sbx lifecycle and experimental environment files<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h3 class=\"wp-block-heading\">The host enforces the controls<\/h3>\n<p class=\"wp-block-paragraph\">These controls hold because they <a href=\"https:\/\/www.docker.com\/blog\/runtime-enforcement-not-runtime-advice\/\" target=\"_blank\" rel=\"noreferrer noopener\">run outside the agent process<\/a>. A rule the agent can reach is a rule it can work around, so the rules that matter live on the host. Outbound traffic goes through a <a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/security\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">host-side proxy<\/a> with a deny-by-default policy, which means a destination the agent wants stays blocked until someone adds it to the list. Credentials follow the same logic. For supported HTTP services, the proxy injects them into outbound requests, so the agent can use a credential without the raw value ever entering the VM.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">When one developer\u2019s setup needs to become a team standard, Docker AI Governance can move network, filesystem, and MCP policy into <a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/governance\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">organization-wide controls<\/a>.<\/p>\n<h3 class=\"wp-block-heading\">What the agent can still reach<\/h3>\n<p class=\"wp-block-paragraph\">A microVM can\u2019t hide what you choose to share with it, so the shared parts deserve the most attention.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">The <strong>workspace<\/strong> is the largest of them. It\u2019s mounted read-write by default, so the agent can edit or delete files in your project. <a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/security\/isolation\/#clone-mode\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Clone mode<\/a> gives the agent a private in-VM clone to work in, which protects the host working tree, though the original repository stays readable inside the sandbox.\u00a0<\/p>\n<p class=\"wp-block-paragraph\"><strong>MCP servers<\/strong> and <strong>skills<\/strong> are shared too. A local stdio MCP server runs on the host and shared agent skills use a host-side store, so the agent\u2019s reach extends to both.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">So whichever mode you pick, be sure to read the diff before you run modified code.<\/p>\n<h2 class=\"wp-block-heading\">Choice and capacity: What Docker Sandboxes cost you in setup<\/h2>\n<p class=\"wp-block-paragraph\">Docker Sandboxes may cost some configuration and a supported hypervisor. But Kits and environment files account for the configuration, and they\u2019re also where you get <em>choice<\/em> over agents and tools and the <em>capacity<\/em> to reproduce a setup across a team.\u00a0<\/p>\n<h3 class=\"wp-block-heading\">Kits and environment files<\/h3>\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/customize\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Kits<\/a> make setup repeatable by packaging tools, files, commands, network rules, credentials, and agent instructions. They\u2019re published for different agents, tools, and IDEs, so you can swap what runs inside the sandbox without rebuilding the environment around it. An <a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/configuration\/environment-files\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">sbxenv.yaml<\/a> file records one project\u2019s sandbox configuration, and committing it to the repo lets a teammate recreate the same sandbox with one command, so every developer works from the same setup. (Kits are in early access and environment files are experimental, so plan for changes to both.)<\/p>\n<p class=\"wp-block-paragraph\">The host-enforced controls take some setup too. Network policy requires someone to decide which destinations belong in the workflow, credential mediation adds service bindings and approved domains, and clone mode adds a fetch step before changes land in the host repository.<\/p>\n<h3 class=\"wp-block-heading\">Hypervisor and resource requirements<\/h3>\n<p class=\"wp-block-paragraph\">Running a sandbox takes more from your machine than running a container does. It needs a supported hypervisor, which today means Apple silicon on macOS 14 or later, Windows Hypervisor Platform, or KVM on supported Ubuntu systems, and running inside another VM requires nested virtualization. The separate kernel and Docker Engine also consume more memory and disk than one additional container would.<\/p>\n<p class=\"wp-block-paragraph\">If your machine is the limiting factor, <a href=\"https:\/\/www.docker.com\/blog\/introducing-cloud-sandboxes-start-on-your-laptop-finish-in-the-cloud\/\" target=\"_blank\" rel=\"noreferrer noopener\">Docker Cloud Sandboxes<\/a> run the same microVM isolation on Docker-managed compute, and one command moves a sandbox between your laptop and the cloud. Local and cloud sandboxes keep separate secrets and network policies.<\/p>\n<h2 class=\"wp-block-heading\">How do you choose between a container and Docker Sandboxes?<\/h2>\n<p class=\"wp-block-paragraph\">Choose a container when you control the code and its dependencies, and choose Docker Sandboxes when the workload generates or fetches code at runtime and needs its own boundary.<\/p>\n<div class=\"wp-block-ponyo-table\" data-highlighted-columns=\"null\" data-highlighted-rows=\"null\">\n<table class=\"responsive-table\">\n<tbody class=\"wp-block-ponyo-table-body\" data-highlighted-columns=\"[]\" data-highlighted-rows=\"[0]\">\n<tr class=\"wp-block-ponyo-table-header\">\n<th class=\"wp-block-ponyo-cell\" data-responsive-table-heading=\"Reach for a container when\">\n<p class=\"wp-block-paragraph\">Reach for a container when<\/p>\n<\/th>\n<th class=\"wp-block-ponyo-cell\" data-responsive-table-heading=\"Reach for Docker Sandboxes when\">\n<p class=\"wp-block-paragraph\">Reach for Docker Sandboxes when<\/p>\n<\/th>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">You control the code and its dependencies<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">The workload generates or fetches code at runtime<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">Execution is short-lived and rebuilt from an image<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">The session accumulates state for hours<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">The workload doesn\u2019t need Docker, or runs in CI that already provides it<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">The workload needs its own Docker Engine with no path to the host socket<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">You want maximum density and a fit with Compose or Kubernetes<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">You need host-enforced network and credential policy the workload can\u2019t switch off<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<tr class=\"wp-block-ponyo-table-row\">\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">The kernel boundary is enough for the code you\u2019re running<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<td class=\"wp-block-ponyo-cell\">\n                    <span class=\"responsive-table-label\"><\/span>\n<p>                    <span class=\"responsive-table-value\"><br \/>\n                                                    <span class=\"responsive-table-value-content\"><\/span><\/span><\/p>\n<p class=\"wp-block-paragraph\">You want a hypervisor between the workload and your kernel<\/p>\n<p>                    <br \/>\n                                            \n            <\/p><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p class=\"wp-block-paragraph\">If any of the signals below apply to your project, you should start with Docker Sandboxes.\u00a0<\/p>\n<ol class=\"wp-block-list\">\n<li>The agent runs unattended, or its permission prompts are auto-approved<\/li>\n<li>The agent needs to build images or run Compose or Testcontainers<\/li>\n<li>The agent reads input you didn\u2019t write, such as issues, web pages, package metadata, or MCP output<\/li>\n<li>The agent requires API keys you don\u2019t want inside its environment<\/li>\n<li>The session lasts longer than a single task<\/li>\n<\/ol>\n<p class=\"wp-block-paragraph\">Start with <code>sbx run claude<\/code>. Add clone mode, kits, network policy, credential mediation, and organization governance as your workflow grows.<\/p>\n<h2 class=\"wp-block-heading\">Sandbox the agent, containerize the application<\/h2>\n<p class=\"wp-block-paragraph\">Containers aren\u2019t going anywhere. For services, CI jobs, and anything you package to ship, they draw the right boundary, and the ecosystem around them is the reason they\u2019ll keep doing that work. A coding agent needs more than a container to be trusted with real work. It needs containment, meaning a boundary the model can\u2019t rewrite, controls it can\u2019t reason its way around, and the freedom to choose its tools and scale its setup.\u00a0<\/p>\n<p class=\"wp-block-paragraph\">Docker Sandboxes provide that containment in a microVM that can still run your containers. The boundary is also what lets the agent move faster. With it in place, you can stop approving every command and let the agent get to work.<\/p>\n<p class=\"wp-block-paragraph\">You can have a sandbox running with one command. Start with <code>sbx run claude<\/code> and the <a href=\"https:\/\/docs.docker.com\/ai\/sandboxes\/\" rel=\"nofollow noopener\" target=\"_blank\">Docker Sandboxes quickstart<\/a>. Once one developer\u2019s setup needs to become a team standard, <a href=\"https:\/\/www.docker.com\/products\/ai-governance\/\">Docker AI Governance<\/a> extends the same controls across your organization.<\/p>\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n<div class=\"wp-block-ponyo-dominique organism\">\n<div class=\"container faq-list\">\n<div class=\"fade-in wp-block-ponyo-frank\">\n<h3 class=\"frank-heading\">\n        Are Docker Sandboxes just containers?<br \/>\n        <span class=\"closed\"><br \/>\n<\/span><br \/>\n        <span class=\"open\"><br \/>\n<\/span><br \/>\n    <\/h3>\n<div class=\"content-outer\">\n<div class=\"content-inner\">\n<p class=\"wp-block-paragraph\">No. A container is an isolated process that shares the host kernel. Docker Sandboxes are microVMs with their own kernel, filesystem, network, and Docker Engine. A sandbox can run containers, which is why the two are easy to confuse.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"fade-in wp-block-ponyo-frank\">\n<h3 class=\"frank-heading\">\n        Can I run Docker inside Docker Sandboxes?<br \/>\n        <span class=\"closed\"><br \/>\n<\/span><br \/>\n        <span class=\"open\"><br \/>\n<\/span><br \/>\n    <\/h3>\n<div class=\"content-outer\">\n<div class=\"content-inner\">\n<p class=\"wp-block-paragraph\">Yes. Each sandbox has a private Docker Engine, so the agent can build images, run Testcontainers, and start Compose applications without the host socket or Docker-in-Docker.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"fade-in wp-block-ponyo-frank\">\n<h3 class=\"frank-heading\">\n        Do Docker Sandboxes replace containers?<br \/>\n        <span class=\"closed\"><br \/>\n<\/span><br \/>\n        <span class=\"open\"><br \/>\n<\/span><br \/>\n    <\/h3>\n<div class=\"content-outer\">\n<div class=\"content-inner\">\n<p class=\"wp-block-paragraph\">No. Containers remain the right tool for packaged applications, CI jobs, and short-lived execution. Sandboxes add a stronger boundary for autonomous agents, and containers keep running inside them.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"fade-in wp-block-ponyo-frank\">\n<h3 class=\"frank-heading\">\n        What\u2019s the difference between a container and containment?<br \/>\n        <span class=\"closed\"><br \/>\n<\/span><br \/>\n        <span class=\"open\"><br \/>\n<\/span><br \/>\n    <\/h3>\n<div class=\"content-outer\">\n<div class=\"content-inner\">\n<p class=\"wp-block-paragraph\">A container isolates a workload. Containment involves the whole environment around an agent: the boundary it runs in, what it can reach, which tools it uses, and how you reproduce it. A container can be part of containment, and Docker Sandboxes add the microVM boundary an autonomous agent needs.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"fade-in wp-block-ponyo-frank\">\n<h3 class=\"frank-heading\">\n        What does an AI agent need from its environment?<br \/>\n        <span class=\"closed\"><br \/>\n<\/span><br \/>\n        <span class=\"open\"><br \/>\n<\/span><br \/>\n    <\/h3>\n<div class=\"content-outer\">\n<div class=\"content-inner\">\n<p class=\"wp-block-paragraph\">Docker describes four requirements: containment (a boundary the model can\u2019t rewrite), control (visibility into what the agent is doing and the ability to stop it), choice (swapping models, agents, and tools without rebuilding), and capacity (a setup other developers can reproduce and scale past one machine).<\/p>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"fade-in wp-block-ponyo-frank\">\n<h3 class=\"frank-heading\">\n        What do I need to run Docker Sandboxes?<br \/>\n        <span class=\"closed\"><br \/>\n<\/span><br \/>\n        <span class=\"open\"><br \/>\n<\/span><br \/>\n    <\/h3>\n<div class=\"content-outer\">\n<div class=\"content-inner\">\n<p class=\"wp-block-paragraph\">A supported hypervisor, which means Apple silicon on macOS 14 or later, Windows Hypervisor Platform, or KVM on supported Ubuntu systems. Running inside another VM requires nested virtualization.<\/p>\n<\/div>\n<\/div>\n<\/div><\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>If you\u2019ve used Docker for a while, \u201cDocker Sandboxes\u201d might read as \u201ca container with an AI agent inside.\u201d Containers [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":5335,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4],"tags":[],"class_list":["post-5334","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-docker"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=5334"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/5334\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/5335"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=5334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=5334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=5334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}