What is a sandbox for an AI coding agent?

The sandbox is the environment where a coding agent runs commands, edits files and starts servers while working on a task. OpenHands V1 uses exactly this term and offers three providers: a Docker sandbox (the agent server runs in a container — recommended), a process sandbox (the agent runs as a normal process on your machine — documented as 'unsafe, but fast') and a remote sandbox (a managed or hosted environment). Hosted agents such as Codex cloud tasks, Cursor cloud agents, Grok Bot and OpenHands Cloud are remote sandboxes by construction.

Is running an AI coding agent directly on my machine safe?

Only when a human is watching and approving every command. A process sandbox has no container boundary: the agent's shell has whatever your user has — SSH keys, cloud credentials, browser profiles, other repositories. The failure mode is not the model being malicious; it is prompt injection from a dependency or a hidden .claude/ or .cursor/ config file, which Google's GTIG documented attackers planting in 2026 specifically to make coding agents run scripts. For anything unattended, use a container or remote runtime.

Docker sandbox vs remote sandbox: which is better for AI agents?

Docker is better when you want the code and credentials to stay on infrastructure you control, need low latency to local files, or run many short tasks — it costs nothing beyond your machine and gives a real isolation boundary with a mountable workspace. Remote sandboxes are better for long-running or parallel tasks that should not depend on your laptop, for teams that want central policy, audit and cost controls, and when the agent needs its own persistent computer with a browser. The trade-off is data leaving your perimeter and per-session pricing.

Can an AI agent use Docker inside its own sandbox?

Yes, in some setups. OpenHands Enterprise lets agents run a Docker daemon inside their own sandbox so they can pull and run containers, bring up Docker Compose stacks and build images to verify a Dockerfile — without touching the host's Docker daemon, cluster or other tenants. The common alternative of mounting the host's Docker socket into the sandbox gives the agent effective root on the host and defeats the isolation.

Quick Answer

Docker vs Process vs Remote Sandbox for AI Coding Agents

Published: September 10, 2026

The Short Answer

	Docker sandbox	Process sandbox	Remote sandbox
Where the agent runs	In a container on your machine/server	As a normal process under your user	On a provider’s or your cloud’s machine
Isolation	Container boundary; workspace mounted explicitly	None — everything your user can reach	Strong; separate machine per session
Speed / latency	Fast; small container start-up cost	Fastest	Network round-trips; slower file sync
Cost	Free beyond your hardware	Free	Per session/compute, or bundled in a plan
Data location	Stays with you	Stays with you	Leaves your perimeter
Unattended runs	Good, with egress allowlist	Do not	Best; survives laptop sleep
Parallel tasks	One container per task	Collide on the same files	Native (one machine per session)
Examples (Sep 2026)	OpenHands default (`RUNTIME=docker`); Claude Code / Codex CLI wrapped in a container	OpenHands `RUNTIME=process`; Claude Code, Codex CLI, Aider on the host by default	OpenHands Cloud / remote, Codex cloud tasks, Cursor cloud agents, Grok Bot, Claude Cowork remote sessions

Rule of thumb: watching the agent in a terminal → process or Docker; anything scheduled, long-running or parallel → Docker with a network allowlist if the data must stay home, remote if it need not.

Docker sandbox: isolation you control

OpenHands’ docs make the case in two lines — isolation: reduces risk when the agent runs commands; reproducibility: consistent environment across machines — and set Docker as the default. The pattern generalises to any agent:

The agent server runs inside the container; your repo is mounted into a workspace (openhands serve --mount-cwd, or SANDBOX_VOLUMES=$PWD:/workspace:rw). The docs’ warning is the point: anything mounted read-write into /workspace can be modified by the agent — and nothing else can.
Credentials are whatever you pass in, not whatever is in your home directory.
Networking can be --network none plus a proxy sidecar, giving you a deny-by-default egress policy for free.
Each task can get a fresh container, which is how you run several agents in parallel on one box without them stepping on each other’s files.

Costs: a few seconds of start-up, image maintenance, and some friction when the task itself needs Docker (see below). For teams that cannot let source or keys leave the building, Docker is the obvious choice.

Caveat — do not mount the Docker socket. Passing /var/run/docker.sock into the sandbox lets the agent control the host’s Docker daemon, which is root-equivalent. OpenHands Enterprise instead runs a Docker daemon inside the sandbox so agents can build images and run Compose stacks “without privileged access to your cluster.”

Process sandbox: fast and unsafe

Running the agent as a plain process is what Claude Code, Codex CLI and Aider do by default, and what OpenHands calls RUNTIME=process (“unsafe, but fast”). It is the right choice for interactive work: zero setup, instant file access, your real toolchain.

It is the wrong choice for anything you are not watching, because the agent’s shell inherits your user: ~/.ssh, ~/.aws, browser cookies, every other repo on the disk. The threat is not the model deciding to misbehave — it is input the model did not write. Google’s Threat Intelligence Group reported on September 8, 2026 that the UNC6780 crew’s DUSTMAKER malware drops files into .claude/, .cursor/ and .vscode/ directories and uses them to instruct the coding assistant to run scripts such as setup.mjs during routine work, and publishes trojanised MCP servers to PyPI with valid SLSA attestations that pass agents’ automated trust checks. In a process sandbox, that script runs as you.

Permission prompts mitigate this while you are present. They do nothing at 3 a.m.

Remote sandbox: someone else’s computer, by design

A remote sandbox runs the agent on a machine that is not yours — OpenHands’ RUNTIME=remote and OpenHands Cloud, Codex cloud tasks, Cursor’s cloud agents, xAI’s Grok Bot (each Bot gets a persistent cloud computer with browser, filesystem and terminal), Anthropic’s Claude Cowork remote sessions (beta from September 1, 2026, which keep working while your laptop sleeps).

Advantages:

Durability. The task does not die when you close the lid.
Parallelism. One machine per session; run ten and review the diffs.
Central policy. Admin allowlists, audit logs and spend controls live in one console. Grok Bot Enterprise, for instance, adds Network Controls with destination allowlists and OpenTelemetry export.
Own browser and desktop. Agents that must click through web apps need a machine with a display; that is a remote sandbox’s natural home.

Costs and risks:

Data leaves your perimeter. Check the vendor’s retention and review terms; OpenAI offers zero-data-retention options and Anthropic’s Enterprise Frontier Safeguards (September 1, 2026) keep monitoring logs in your own cloud, but defaults vary.
Shared-machine defaults. In Grok Bot, all of one user’s Bots share that user’s cloud computer, so a credential on it is visible to every Bot the user runs.
Price. Bundled in ChatGPT/Claude/Cursor plans up to a limit, then metered; OpenHands Cloud is a commercial licence.

Decision guide

Situation	Pick
Pair-programming in a terminal, you approve commands	Process (or Docker if the repo has untrusted deps)
Scheduled jobs: CI fixes, issue triage, dependency bumps	Docker + egress allowlist (OpenHands automations, or Claude Code/Codex in a container)
Regulated data, keys that cannot leave	Docker on your own hosts; remote only in your own VPC
Long tasks that must outlive your laptop	Remote (Cowork remote sessions, Codex cloud, OpenHands Cloud)
Many parallel tasks with review at the end	Remote, or one Docker container per task
Agent must drive a browser or desktop app	Remote with its own display, or a dedicated VM
Task itself needs Docker (Compose, image builds)	Remote with in-sandbox Docker (OpenHands Enterprise), or a VM — never a mounted host socket

Whichever you choose

Enforce network policy outside the agent. Every 2026 incident — OpenAI’s agents writing to a “read-only” wiki, breaching Hugging Face via a repurposed package server, attackers’ agents harvesting credentials from a hijacked cloud — was a boundary that existed in the prompt, not the network.
Scope credentials per task. Short-lived tokens, no ambient secrets in the sandbox.
Keep an event log the agent cannot edit. OpenHands’ append-only event stream and CrowdStrike’s Falcon Guardian execution graph both model prompt → tool call → system action; replicate that chain wherever you run.