Two ways to start docker-agent in a sandbox
Two columns, one per launch path. Left: sbx run docker-agent on a project directory, where sbx creates the sandbox from docker/sandbox-templates:docker-agent, starts docker-agent run --yolo inside, reads only project config in the workspace, and applies the sbx policy; this manual has no capture of it. Right: docker-agent run --sandbox agent.yaml, where the host docker-agent drives sbx with docker/docker-agent-sbx-templates:latest, the binary inside reports version main, the agent file directory and the kit are mounted read-only, and models.dev and the sandbox allow hosts are opened; recorded in the capture.
A · sbx run docker-agent
B · docker-agent run --sandbox
you type
sbx run docker-agent ~/my-project
sbx creates the sandbox
docker/sandbox-templates:docker-agent
startup command inside
docker-agent run --yolo
agent file
project config in the workspace only
network
the sbx policy of the sandbox
in this manual
docs only, no capture
you type
docker-agent run --sandbox agent.yaml
docker-agent drives sbx
docker/docker-agent-sbx-templates:latest
agent binary inside
docker-agent version main
agent file
its directory mounted ro, kit ro
network
sbx policy, plus models.dev and allow hosts
in this manual
the recorded run