One docker-agent run --sandbox, step by step
Seven lifelines: the operator, docker-agent v1.149.0 on the host, the .m101 state directories in the workspace, sbx with sandboxd, the sandbox VM, the host proxy on port 3128, and Docker Model Runner on port 12434. Fifteen rows: sandbox allow writes localhost:12434 to the persistent allowlist; run --sandbox --exec stages the kit sandbox-kits/<hash>, asks sbx to create docker-agent-<hash> from docker-agent-sbx-templates:latest, the sandbox becomes running with 10 CPUs and 32 GiB, and docker-agent allows models.dev and localhost:12434 on the proxy. Inside the VM the session store fails with readonly database (1032). An sbx exec then runs docker-agent inside with its data in /tmp/m101; its model call goes to host.docker.internal:12434 through the proxy, which forwards it to localhost:12434; the answer streams back as chat.completion.chunk events and the operator reads README.md with 1 line. sbx rm --force removes the sandbox.
operator
your shell
docker-agent
v1.149.0
.m101 dirs
in workspace
sbx
and sandboxd
sandbox VM
the guest
proxy :3128
on the host
Model Runner
:12434
1
sandbox allow
localhost:12434
2
+ localhost:12434
persistent allowlist
3
run --sandbox --exec
files-sandbox.yaml
4
sandbox-kits/<hash>
the auto-kit
5
create docker-agent-<hash>
docker-agent-sbx-templates:latest
6
created, running
cpu 10, memory 32 GiB
7
allow models.dev
and localhost:12434
8
readonly database (1032)
creating session store
9
sbx exec docker-agent run
data dirs in /tmp/m101
10
host.docker.internal:12434
through HTTP_PROXY
11
localhost:12434
the sandbox allow rule
12
chat.completion.chunk
the streamed answer
13
README.md with 1 line
exit 0
14
sbx rm --force
15
removed