# Oleg Šelajev - You're absolutely right, it was your home directory! - AI Native DevCon June 2026

## Executive summary

The session addresses the security risks posed by autonomous AI agents running locally, noting that these agents can pose significant threats by accessing sensitive data and executing arbitrary code. To mitigate this risk, Docker introduces sandboxing using MicroVMs—a hardware-level isolation primitive superior to traditional containers. This approach allows developers to run powerful AI agents in a restricted environment with controlled access to the filesystem, network, and secrets, enabling high productivity without sacrificing security.

## Key takeaways

- The Danger of Autonomous Agents: AI agents are highly autonomous and persistent; if given sufficient access (data, external communication, internet), they can execute malicious actions like stealing SSH keys or cloud credentials, leading to massive security incidents. The stakes are asymmetric: the attacker only needs to succeed once.
- MicroVMs for Hard Isolation: Traditional containers share a kernel and are insufficient for high-stakes AI agent sandboxing due to potential container escaping exploits. Docker's solution uses MicroVMs, providing hardware-level isolation that significantly raises the security boundary.
- The Role of Kits (YAML): To improve developer experience in isolated environments, 'Kits' are introduced. These declarative YAML files define reusable configurations for a sandbox, specifying required commands, tools (e.g., programming language toolchains), file placements, and network rules.
- Controlled Access Mechanisms: Sandboxes implement critical controls including networking proxies (to block specific domains/services) and secrets injection mechanisms, allowing agents to function without direct access to the host machine's private data.

## Technical details

- AI Agent Security Risks: Agents can exploit vulnerabilities by installing malicious dependencies (e.g., via Python) or performing prompt injections, leading to unauthorized access of secrets and credentials.
- Container vs. MicroVM Isolation: Containers are ideal for immutable software but fail when an agent needs to actively change its environment (install tools). MicroVMs provide the necessary hardware-level isolation boundary that security teams require.
- SBX Sandbox Workflow: The `SBX run` command executes agents (e.g., Claude, Gemini) within a fully isolated MicroVM environment. This sandbox can run tests and build projects while enforcing network policies and limiting file system access.
- Sandbox Configuration with Kits: Kits are YAML-defined artifacts that manage the setup of a sandbox by defining commands (e.g., `install Tessel`), environment variables, network rules, and secure credential swaps.

## Practical implications

- Developers can run powerful AI agents locally on their machines with significantly reduced risk by utilizing hardware-isolated sandboxes.
- The `SBX` CLI tool provides a straightforward way to initiate isolated agent sessions (`sbx run [agent]`).
- Teams can standardize sandbox environments using declarative 'Kits' (YAML files), ensuring consistent and secure development setups across multiple users.
- The system supports integrating sandboxing into existing developer workflows, such as running agents within IDE panes (e.g., VS Code).

## Topics

AI Agents, Security Engineering, Containerization, MicroVMs, DevOps, SBX, The AI Native Dev Podcast, Docker Documentation

Source: https://www.youtube.com/watch?v=bFBNXIoLkW4