# Docker, Adobe & tldraw: Where Should Your Agent Run?

## Executive summary

The discussion explores the critical architectural question of where AI coding agents should execute, presenting four distinct models: Docker advocates for secure microVM sandboxes; Helix ML proposes centralized, dedicated computing resources for each agent; Adobe demonstrates running the agent loop entirely within the browser tab; and tldraw visualizes agents collaborating as characters on an infinite canvas. The consensus highlights the trade-offs between isolation, centralized control, and environmental fidelity.

## Key takeaways

- MicroVMs for Agent Sandboxes: Docker recommends using micro VMs instead of traditional containers for agent sandboxes because enterprise security teams view shared kernels as an unacceptable isolation boundary.
- Centralized Agent Infrastructure: Helix ML argues for giving every agent its own dedicated computer on centralized infrastructure (e.g., Kubernetes) to facilitate seamless handoffs of work across global time zones.
- Browser-Native Agent Loops: Adobe demonstrated an agent that runs its entire loop and controls the browser from within the browser tab, showcasing the concept of the 'self-licking ice cream cone' (SLICC).
- Collaborative Canvas Agents: tldraw presents agents as interactive characters on a canvas that can coordinate, plan, and execute tasks as a team, allowing for simultaneous, visible collaboration.

## Technical details

- Docker Sandboxing: Docker's sandboxes use micro VMs to ensure hardware-level isolation, preventing access to the host file system and controlling all outbound requests via a networking proxy. Secrets injection mechanisms are used to provide necessary data without exposing private credentials.
- Centralized Agent Architecture: The centralized approach suggests running agents on an organization's dedicated infrastructure (e.g., Kubernetes) rather than relying on individual developer machines, enabling global team handoffs.
- Browser-Based Agent Control: Adobe's agent runs the entire agent loop within the browser, allowing it to control the displayed browser environment directly, rather than merely displaying results from a cloud runtime.
- Agent State Visualization: tldraw allows agents to exist as instances on a canvas, visualizing their state (e.g., thinking, reviewing, working) and coordinating complex tasks like playing a game as a unit.

## Practical implications

- Security teams require hardware-level isolation (micro VMs) for agent sandboxes.
- Centralized infrastructure is beneficial for global, asynchronous team collaboration.
- Running agents natively within the browser enhances environmental fidelity and control.
- Canvas-based visualization provides a powerful model for observing and coordinating multi-agent systems.

## Topics

AI Agents, MicroVMs, Containerization, Distributed Systems, Browser Automation, Build Engineering, Docker, Helix ML, Adobe, tldraw, SLICC

Source: https://www.youtube.com/watch?v=SLh-wN45ZIM