Docker Sandboxes vs semantic
Docker Sandboxes run agents in microVMs with a separate kernel per sandbox, on your machine or on Docker-managed cloud compute. [1][2]
Outbound TCP goes through a host proxy, denied unless allowlisted, and the proxy injects API keys so credential values never enter the VM. [2] In direct mode, workspace changes land on the host live. [2] Semantic decides which paths, repos and branches the agent may write, and logs refusals.
| Docker Sandboxeslocal · Docker cloud | Semantic (smx)microVM + policy on your machines | |
|---|---|---|
| Isolation | microVM, separate kernel per sandbox [2] | One microVM per agent, own kernel |
| Where it runs | Your machine or Docker-managed cloud [1] | Managed private beta; on-prem for enterprise (contact us) |
| Egress rules | Host proxy, deny by default with allowlist [2] | Security profiles enforced by host firewall; metadata and link-local always closed |
| Credentials kept out | Proxy injects credentials; values never enter the VM [2] | Git tokens, SSH keys and model sign-ins stay on the host |
| File, Git, SSH permissions | not documented | Per path, repo, branch and SSH host; deny beats allow; enforced on the host |
| Tamper-evident agent log | not documented | Hash-chained log of runs, events and refusals; read with smx agent logs |
| Snapshots, pause/resume | not documented (sandboxes persist across stop and restart) [3] | Snapshot, pause and resume with memory, disk and running processes |
| Local hosts (Linux / WSL2 / macOS) | Linux (Ubuntu 24.04+ with KVM), macOS 14+ Apple silicon, Windows 11; WSL2 — [4] | Linux (KVM) and Windows via WSL2; macOS planned |
| License | Not open source; CLI and local use free [1] | Proprietary (private beta) |
Which one fits
When Docker Sandboxes fits better
- Your team already uses Docker and wants the same tool on Mac, Windows and Linux. [4]
- You want to move a sandbox to Docker's cloud. [1]
When Semantic fits better
- Agents work on your repos and you need branch-level Git and per-path file permissions enforced outside the agent.
- You need a tamper-evident log of what the agent did inside the sandbox, including refusals.
- You need snapshots with memory and running processes.
Shared state between sandboxes
Docker's security docs warn that with shared agent skills, one sandbox can modify instructions or scripts that an agent later uses in another sandbox. [2] Semantic grants each sandbox its own file policy, with deny beating allow.
Questions
Is Docker Sandboxes open source?
No open-source license is stated; the CLI and local use are free, including commercial work. [1]
Can Docker Sandboxes block Git pushes to main?
Its docs describe no branch-level policy. Semantic refuses the push on the host and logs it.
Sources
- Docker Sandboxes overview · last verified 2026-10-27
- Docker Sandboxes security · last verified 2026-10-27
- Docker Sandboxes architecture · last verified 2026-10-27
- Docker Sandboxes install · last verified 2026-10-27