What sbx owns and what docker-agent owns
Two columns over two bands. In the host band, sbx owns the sbx v0.47.0 CLI, the sandboxd daemon on its socket, the macOS Keychain that holds secrets, and the proxy on gateway.docker.internal:3128. docker-agent owns the docker-agent v1.149.0 binary, the agent file, the staged kit under sandbox-kits, and the persistent allowlist with localhost:12434. A dashed line marks the hypervisor. In the guest band, sbx owns the Linux 7.0.14 kernel, the private Docker Engine 29.8.1, the virtiofs workspace mount at the same path, and the environment with proxy variables and proxy-managed keys. docker-agent owns only the loop inside: the docker-agent process, its filesystem and shell tools, and its model call.
owned by sbx
owned by docker-agent
HOST · MACOS 26.2 ARM64
sbx v0.47.0
the CLI you type
sandboxd
sandboxd.sock
Keychain
sbx secret set
proxy :3128
policy, key swap
docker-agent
v1.149.0, Homebrew
agent file
files-sandbox.yaml
sandbox-kits/<hash>
the staged kit
allowlist
localhost:12434
Hypervisor.framework · kern.hv_support: 1
GUEST · ONE MICROVM PER SANDBOX
Linux 7.0.14 aarch64
its own kernel, Ubuntu 26.04.1
Docker Engine 29.8.1
its containers stay out of docker ps
workspace mount
virtiofs rw, same absolute path
environment
HTTPS_PROXY, keys proxy-managed
docker-agent process
the loop: model, tools, sub-agents
filesystem, shell
tools that run in the VM
model call
host.docker.internal:12434
nothing else in the guest