One agent, one microVM, one proxy
The recorded docker-agent run --sandbox on the capture Mac, drawn as machines on a host bench above a glass microVM. On the host, docker-agent v1.149.0 stages the kit sandbox-kits/<hash>, writes the allowlist with models.dev and localhost:12434 into the proxy rules, and asks sbx and sandboxd v0.47.0 to create the sandbox, which becomes running. Below the Hypervisor.framework line, the microVM docker-agent-<hash> from docker/docker-agent-sbx-templates:latest holds docker-agent version main, its filesystem and shell tools, four workspace mounts, and an environment whose proxy is gateway.docker.internal:3128 and whose provider keys read proxy-managed. The model call goes up to host.docker.internal:12434, through the proxy on :3128, and on to Docker Model Runner on port 12434 with ai/qwen3:4b. The answer is: The working directory contains README.md with 1 line.
HOST · MACOS 26.2 ARM64
docker-agent run --sandbox --exec files-sandbox.yaml
docker-agent
v1.149.0
Homebrew
sbx, sandboxd
v0.47.0
creates the VM
proxy :3128
on the host
applies the rules
Model Runner
ai/qwen3:4b
port 12434
sandbox-kits/<hash>
the kit docker-agent staged
allowlist
models.dev
localhost:12434
create
created, running
Hypervisor.framework · kern.hv_support: 1
environment
HTTP_PROXY gateway.docker.internal:3128
ANTHROPIC_API_KEY=proxy-managed
docker-agent main
commit 154b78f2
runs files-sandbox.yaml
4 workspace mounts
repo-sandbox rw, agents ro
sandbox-kits ro, cfg ro
filesystem, shell
tools that act on
the mounts
microVM docker-agent-<hash> · docker/docker-agent-sbx-templates:latest
host.docker.internal:12434
through HTTP_PROXY
:12434
The working directory contains README.md with 1 line.