YT YouTube2Text

YouTube2Text → Transcripts → Docker Sandboxes - Safe and Secure Agents

Docker Sandboxes - Safe and Secure Agents — Transcript

by Sam Witteveen · 4,421 words · 592 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00Okay, so one of the biggest pain points
0:02at the moment if you're running any kind
0:04of agent is the whole safety factor.
0:07Now, this can be if you're running
0:08coding agents, things like Claude code,
0:11Codex, etc. Where you just don't want to
0:14have to sit there babysitting doing yes
0:16allow, yes allow, no don't touch that
0:19for the next sort of 3 hours. Now, of
0:21course you've got the option of
0:22dangerously skip permissions, but then
0:25you've got to worry about what it's
0:26actually going to do to your system, is
0:28it going to wipe your drive, etc. And
0:30all of this is compounded if you're
0:32using agents like Hermes or open claw or
0:35even creating your own custom agents.
0:38So, while we want our agents to
0:40basically have autonomy and to be able
0:42to do different things, we also want to
0:45have them locked down so that they're
0:48safe and they're not just going to wipe
0:50your hard drive, etc. This is where
0:52Docker has been working on a really good
0:53solution for this and they've agreed to
0:55sponsor this video so I can tell you all
0:57about it. So, what I'm talking about is
0:59Docker sandboxes.
1:00So, the idea here is that you can use
1:03these for coding agents, you can use
1:06these for sort of local personal agents,
1:08you can even use it for your own custom
1:10agents. But, what it is doing is
1:13allowing you to create a sandbox where
1:16you determine things like what network
1:19access the agent can have, where you
1:21determine what models it can use, where
1:23you determine things like what storage
1:25folders it's allowed to read from and
1:28also what folders it's allowed to
1:29actually write to, etc. And then
1:31probably one of the biggest ones is you
1:33want to basically have a way to lock
1:36down your credentials so that the agent
1:39itself can't just start going out and
1:41giving your credentials to other people
1:43if someone tries to prompt inject it,
1:45etc. So, Docker sandboxes allows you to
1:48basically lock all of these things down
1:51and to define simple policies that give
1:53you the control that you want for each
1:55of the things that you want your agent
1:56to be able to do. So, in this video I'm
1:58going to look at how to basically set
2:00this up. We'll look at creating
2:02sandboxes. We'll look at how do you give
2:04different sandboxes different
2:06permissions, et cetera. How do you allow
2:08it to have access to the credentials?
2:10How do you set up a proxy for
2:12credentials? And for me, one of the
2:14biggest things here is just how quickly
2:17you can basically try out new agents
2:20that are out there, set them up and
2:22connect them to perhaps a local model on
2:24LM Studio or something, run them for a
2:27few hours to see how they actually go,
2:30and not have to worry, is this thing
2:32going to be making changes to my
2:33computer or messing up my file system,
2:35et cetera. All right, so let's start off
2:37with what actually this is. This is not
2:40normal Docker containers. So, Docker's a
2:42fantastic tool. I think most people in
2:44development have used it for a long
2:46time. It's certainly the way to be able
2:49to set up environments that you can then
2:51use both locally and put into
2:53production, et cetera. But, generally
2:55Docker kind of containers are great for
2:58packaging up an app. They're not
3:00necessarily ideal though for agents.
3:03What Docker sandbox is is actually is
3:06sandboxes that we're going to be making
3:08is a micro VM. So, this is a small, fast
3:12VM with its own Linux kernel that's
3:15separate from yours. And one of the key
3:17things here is that this is all about
3:19the hypervisor. So, the hypervisor is
3:21basically a layer that creates and runs
3:24VMs. It sits between your hardware and
3:27the virtual machine, and it can hand off
3:29sort of like a slice of your CPU, your
3:33memory, et cetera, to the actual VM. And
3:36the key thing here is that this is
3:37hardware enforced. It's not just
3:39software, et cetera. And so, this idea
3:41of a micro VM is a fully contained
3:44solution that actually has more
3:47isolation to it than normal sort of
3:49containers. So, full VMs, they isolate
3:52things fine, but they can often be quite
3:54chunky, slow, takes time to spin them
3:57up, takes time to spin them down. The
3:59micro VM sits in the middle and gives
4:01you sort of real virtual machine level
4:04isolation, but boots really fast and can
4:07tears down really fast. And this is
4:09exactly what you want for agents. Now,
4:12inside each of those VMs, you've got a
4:15sort of Docker engine in there. You can
4:17install packages, you can run things,
4:19you can make a mess. And when you're
4:21done, you can just throw the whole thing
4:23away, and it won't have affected
4:24anything on your machine here. So, let's
4:27jump in and look at how we can actually
4:28create these, and then how we can
4:30actually set this up with something like
4:32a local agent on a machine, and let it
4:34run wild, and see what we can actually
4:36do where we're not having to pay for
4:38external tokens, we're not having to
4:39worry about stuff. We can just let the
4:41agent run, and then evaluate that at the
4:44end. Okay, so the first thing you want
4:46to do is actually set this up. So, to do
4:49that, once you've got it installed, and
4:51the instructions are pretty easy to get
4:53it installed on the different platforms,
4:55you want to come in here and just do sbx
4:57login. What that will basically get you
5:00is that will link this to a Docker
5:03account. And once you basically
5:05authenticate your account there, it will
5:07then authorize your system. Now, it's
5:09totally free, it's not going to cost you
5:11anything to do this. My guess is this is
5:13just Docker's way of enforcing
5:15enterprises to use paid accounts, etc.
5:18Now, once we've logged in, the simplest
5:21use of this is just to use it for coding
5:24agents. So, for example, one of the big
5:27issues you're going to have with various
5:29coding agents is that you don't want
5:32them going crazy and messing up your
5:34file system. So, you can see here, if I
5:37come in and I do sbx run codex, it's
5:41going to start up codex, but this codex
5:45is actually now running in the Docker
5:48sandbox here in this folder that I've
5:50called codex test. Now, if we come out
5:53and actually look at here what is
5:55running, you can see I can just do SBX
5:58LS and you'll see that sure enough I've
6:01got a number of different sandboxes
6:03here. The one that's running at the
6:05moment is this codex test with the agent
6:08codex in there. So, you can see that
6:10it's basically got access to everything
6:13in here. If I ask it to write me a read
6:16me with today's time but in the folder
6:20one up from this, you'll see that okay,
6:23it's able to go off and look like it's
6:25running the various sort of commands as
6:28it goes through this but you're going to
6:29see that it's actually sandboxed so it
6:32won't be able to write to this
6:34particular directory. In fact, it can't
6:36write to anything on the actual machine
6:38there except this folder that we're in.
6:40So, you can see if I go out and I
6:43actually go up to that directory, there
6:45is no read me in there. Yet it thinks
6:48that it's actually done it but it's
6:50actually been blocked when it was
6:51actually trying to do a read me there.
6:54But if I want to write something in this
6:56folder, like I want to actually do code
6:58and stuff in this folder, that will have
7:00no problems, right? It will go off, it
7:03will check what's in this folder but
7:05then it can write an HTML file, it could
7:07write a set of next JS files, etc. no
7:10problem in here. Okay, so you'll see
7:12that if we come out and we go to that
7:15folder, we can see that our index.html
7:17file has nicely been written there.
7:20And sure enough, if we look at it, we
7:21can see that it's exactly what codex
7:25wrote in there. So, this is the basic
7:27sort of security that the sandbox gives
7:29you is it stops agents or anything that
7:32you've got running in there being able
7:34to access other folders or erase things
7:37on your disk etc. And if I come out of
7:39the sandbox and I can actually go in
7:41there and see, okay, what network
7:44connections was it connecting to in
7:46here? Now, the first time you set it up,
7:48you will actually get to be able to
7:50choose whether you want your sandboxes
7:52to be open, fully closed, or balanced.
7:55Now, at any point, you can also reset
7:57that. So, if I come back to SBX policy
7:59and I select reset in here, it will
8:02first make sure that it's closed down
8:04all the different sandboxes that I had
8:07running. But, you'll see then I've got
8:08the option to basically select open, so
8:11I don't block any network traffic,
8:13there's no restrictions or anything. I
8:15can have it fully locked down where all
8:18network traffic gets blocked. But,
8:20probably most of the time you're going
8:21to want to do this balanced. All right,
8:23so let's make a completely new sandbox
8:25here. So, I'm going to do SBX run. I can
8:29do create, but if I'm going to do run,
8:30it's just going to create it and run it.
8:33I'm going to go for Claude this time,
8:35and I'm going to give it a name of
8:37testing CC. So, you'll see that it it's
8:40already downloaded the different sandbox
8:43files here. So, it was able to basically
8:46just get those going. Because I've used
8:49this before, it's already downloaded
8:50them. If you don't have them there, it
8:52would go through this. Now, first off,
8:54I'm going to need to do my standard sort
8:56of login. In this case, I'm just going
8:58to login with my account. All right, so
9:00I've gone through, I've done my login
9:02with the web, etc. And you can see it's
9:04basically got the bypass permissions on.
9:07So, it's running in dangerous sort of
9:08mode in here. What I'm going to do
9:10though is actually just exit out of this
9:13so that we can look a little bit about
9:14the network rules that were actually in
9:16there. So, to do this, we do SBX LS just
9:19to see what sandboxes we had there.
9:21We've already stopped this one, so we're
9:23doing this testing CC. So, SBX policy LS
9:28testing CC. Now, I can tell it that I
9:31want to see all the different network
9:33settings for this. And you see there's
9:34192 hosts basically in there. If I
9:38wanted to actually see them all, I can
9:40actually go through and see what's in
9:42here and what's approved and stuff like
9:43that. So, this is on the balance
9:45settings. So, it's set up for a generic
9:47use case across everything from ChatGPT,
9:51Cursor, OpenAI, and Anthropic. You'll
9:54have AWS in there. You'll probably have
9:56some Google APIs in there,
9:58gemini.google.
9:59You've got a variety of these things in
10:02there. Now, if you wanted to, you can
10:04actually come in and make your own
10:06network policy from scratch, so you can
10:09lock it down. The next thing I wanted to
10:11show you though is probably the bit that
10:12I think is more interesting than just
10:14the coding agents. The coding agents is
10:16really sort of rock solid for you to be
10:18able to do your day-to-day coding. But,
10:21if you're building agents, whether
10:23that's with something like deep agents
10:25or any of the agent frameworks that you
10:27want to work on yourself, you're often
10:30going to want to have your own sandbox
10:34for the agent. And in that sandbox, you
10:37can install packages, you can install
10:40anything that you need to in there. But,
10:43you want to basically limit where it can
10:46write and what it can write to. That
10:48it's just going to write to that local
10:50directory. So, the way we do this is we
10:53basically do run, but rather than
10:55putting Claude code or CodeX or open
10:59code or something like that, we
11:01basically just tell it that we want to
11:03do a shell. And this is going to give us
11:05a sandbox that is purely for a shell.
11:10And then also, I can use a directory
11:12which is a sibling directory to this,
11:13which is shell test. So, that should now
11:17create the new sandbox, set it up, and
11:20you can see now we are in shell test,
11:23right? So, I've got a whole new sandbox
11:25for this with an agent that I can
11:28install, and I could then install all my
11:31scripts in here, and then I can limit
11:33not only what it can read and write
11:34here, but also what it can access over
11:37the network. So, you'll see that if I
11:39just run a curl command here, I'm going
11:41to get told that this was actually
11:43forbidden in here. And you'll see if I
11:45come out of this sandbox, I can also
11:48test this, and we can see that okay,
11:50this example.com is denied there. It's
11:53not allowed for that sandbox. So, I've
11:55got that locked down in there. Now, if I
11:58want to allow it, I can just change the
12:00policy to allow the network on this
12:03sandbox to allow this URL on that
12:06particular port. And you can see that
12:08now the rule has been added to the
12:10policy. And if I check this again now
12:12and run it, you can see sure enough now
12:14it's allowed. So, the cool thing there
12:16is you're able to lock down and limit
12:18everything about what your sandbox can
12:21read and write. We could also set it up
12:23so that certain folders just have read
12:26access only, and then other folders have
12:29write access. So, that allows us to
12:31basically then set a bunch of documents
12:33in there that we want to be immutable
12:36that the agent can access, perhaps some
12:39things like that. But then they can't be
12:41overwritten. While we may have like a
12:43folder, which is like a scratchpad
12:46folder where it can write memories to,
12:48it can write use it as a full sub file
12:50system for writing notes to itself. The
12:53next thing we want to be able to do is
12:55look at how we would support keys. So,
12:58anytime I'm testing out a particular
13:00agent that's from GitHub or a new coding
13:03agent or something like that, I don't
13:06want to run it blindly on my machine. I
13:08want to be able to control what it can
13:11actually read and write to and what it
13:13can actually look at on the web. All
13:16right. So, if you want to set something
13:18like a secret in here. So, let's say we
13:20wanted to put it in a secret for the
13:23Open Router API key, right? And I don't
13:27really trust my agent too much whether
13:30it's going to try and exfiltrate that
13:32out or it's going to do something with
13:34it. I can come in here and set the
13:36secret. So, in this case, I'm just going
13:37to put Sam's open router secret in
13:43there, and it's basically been set in
13:46there. You'll see though, if I come back
13:48in here and actually look at the key in
13:51here, all I get out is that it's proxy
13:54managed, meaning that inside the actual
13:57sandbox, you can't see the raw key. You
14:01just see a placeholder, which gets
14:04passed out, and then as it goes out of
14:07the sandbox, it gets converted into the
14:10real key to be sent to open router. So,
14:13using open router would be fine, but I
14:16don't need to worry that, okay, the
14:18sandbox is going to be getting my keys
14:20and then sending them somewhere else.
14:22Now, of course, I could also block all
14:25the network access out apart from open
14:27router if I wanted to. There are a lot
14:29of different ways you can kind of lock
14:31this down. But, just knowing by default
14:34that you're able to basically do this
14:36SBX secret and set it, and you could
14:39also set it as a global key if you're
14:41going to be using it quite often for
14:42multiple sandboxes, etc. Okay, so there
14:45are a bunch of sort of pre-made
14:48templates that you can use to make
14:50sandboxes. So, for example, I showed you
14:52the Codex one. I showed you the Claude
14:54code one. There are also things like
14:56open code and a number of different
14:58things. But, if you want to make your
15:00own sort of templates, Docker's actually
15:03created a system to do that, and that's
15:05called kits. So, I'm not sure if this is
15:07in its fully worked out final version.
15:10You can see they've listed this as still
15:12early access, but anyone can access
15:14this. And what this basically does is it
15:17allows you to set up tools to install
15:21the environment variables, credentials,
15:24network rules, all these kinds of things
15:28to be able to make a kit. Now, kits can
15:30do a whole bunch of different things.
15:32They can install things and create the
15:34environment for you. They can also
15:36basically set up an app and run the app
15:39for you. Now, here is an example of a
15:41kit that I made for a deep agents agent.
15:45So, if you know deep agents from
15:47LangChain, it's basically a framework
15:49that allows you to build agents that
15:51both have access to file systems, have
15:54access to tools, all those kinds of
15:56things. Now, if you look in here, this
15:59is going to basically inherit from a
16:01shell, so it's going to be basically
16:02just be a shell kind of sandbox, but
16:06it's going to have a bunch of properties
16:08that I am setting in here. So, I only
16:11want this to be able to contact open
16:13router and LM Studio. So, you can see
16:16that it's basically set up for the
16:18network to just allow open router and
16:22open router on 443 and localhost on
16:251234, which is the LM Studio. Now, it's
16:28also got some other things in there to
16:29be able to allow Linux updates, to be
16:32able to install PyPI packages, etc. But,
16:36you can see that it's denying OpenAI,
16:39ChatGPT, all the typical sort of things
16:41that we had before.
16:43We can also set up that it's going to
16:44need some credentials, which are going
16:46to be open router, and that I'm going to
16:48set globally. So, that's going to be
16:51injected in via the proxy, right? So, I
16:54don't need to set any of that in here.
16:56If I wanted to, I could actually put my
16:58key in there, but it would kind of
16:59defeat the purpose, right? And then you
17:01can see once this gets created, it's
17:04going to install Python. It's also going
17:06to set up a virtual environment in
17:08there, and it's then going to pip
17:09install a bunch of packages like deep
17:12agents, LangChain, LangChain OpenAI, so
17:15we can use LM Studio's Open AI endpoint
17:18in there and then LangChain Open Router
17:21in there. Now, if I wanted to make it
17:23for Gemini or for something else, I
17:24could certainly add that there. I've
17:26also got then the actual code that is
17:30going to run once this is all installed
17:33in here. So, this is going to be just a
17:35super duper simple little agent, which
17:37is basically a chat. There's no real
17:41tools here. There's nothing all like
17:42that. But, if I wanted to I could put
17:45all of that in here if I wanted to have
17:46something like that going on. And then
17:49I've got a readme of just basically how
17:50to set this up. Okay, so now that I've
17:53built that, that's what's called a kit,
17:56right? So, all the code that I was
17:57showing you there is a custom kit that
18:00I've made for deep agents. To actually
18:02set this up now, what I'm going to do is
18:05I'm going to run SBX run deep agents.
18:08I'm going to basically tell it the
18:10folder that I want it to create in. So,
18:13I'm actually in a folder called my deep
18:15agent here, right? So, that's what the
18:17dot is there. Then I pass in the URL to
18:20the kit, right? So, that kit is under my
18:23Docker sandboxes and there's the deep
18:25agents kit there. You'll see that when I
18:28run this the first time, it would
18:30download any images etc. that it needs
18:33to do that. In this case, because
18:35they're shell, I've already got them.
18:37I've already used this for other
18:38projects etc. It doesn't need that. What
18:41it is going to do though is that it's
18:43going to set up the actual folder. It
18:46needs to install Python. It needs to
18:48install those packages. It needs to
18:49create the virtual environment. So, you
18:51will find that it will take a minute or
18:53a couple of minutes to actually get this
18:55going the first time. Sure enough, it's
18:59just done. Hopefully, you saw all of
19:01that that it basically set it all up and
19:04then it has run that script that we saw
19:07before that was setting up a deep agent
19:09in there. And you can see that okay,
19:11this is what we're actually running. We
19:13can see if we chat to this, because
19:17we've already got our open router set
19:19globally,
19:20the deep agent assistant is able to use
19:23that. It's actually proxying through and
19:25using it. So, if I run this off, I
19:27should be able to get it so that it's
19:29talking to deep seek version 4 flash
19:33latest. Because it should enough it's
19:34saying, "Hi, I'm your coding assistant
19:36ready to help out." Let's see. Now we've
19:38got everything locked down, so it
19:40shouldn't be able to do any sort of
19:42searches or anything like that. Let's
19:44just try this out. Okay, so I'm asking
19:46it, "Can we search Google for the latest
19:48AI news?" And even if it's going to try
19:51and ping one of the URLs there, it's
19:54going to come back and it's just saying,
19:57"Look, I'm sorry, but I don't have the
19:58ability to search the web. Here's what
20:00we're working with." So, the file
20:03systems is actually limited in here.
20:05That's what we put in there. What we can
20:08do, you can see network access says, "In
20:10this sandbox is restricted to just open
20:13router.ai
20:15and local LM Studio." So, it can't get
20:18out of the sandbox in here. If I ask it
20:20to give me a list of files in users,
20:24it's going to go through the same
20:25process and realize that even though
20:26this time it's got reading tools and
20:29writing tools and editing tools, even
20:32though it's got those tools, you can see
20:34here that it basically found out that
20:37there are no files accessible in this
20:39environment at all, cuz we've just set
20:40up the environment, right? So, it says
20:43that it checked users found it empty
20:45{slash} all these things. Really, it
20:47doesn't have access to any of those on
20:49my Mac, so it can't find them. It can't
20:52do anything with them in here. So, you
20:55can see this is how I can lock this
20:57down. At any point if I want to get out
20:59of it, I can just exit just like normal.
21:01And now that I've got set up, I don't
21:03even need to refer to the kit or
21:05anything again. If I want to run it, the
21:07way it's set up is that it's using the
21:09kit name plus the folder name to create
21:12the actual name of the sandbox in here.
21:14But, you can see that now I've got that,
21:16I can run this and it just goes straight
21:18into it really quickly. So, I don't need
21:21to worry anything about it having to set
21:24everything up again each time and stuff
21:26like that. I can now just go in and I've
21:28now got this deep agents agent in a
21:32totally secure sandbox where I could
21:35have it running lots of different tools,
21:38having a scratch pad, having the ability
21:41to write things into its local file
21:43system, but not having to worry about it
21:46going and messing up things from my
21:48entire computer, etc. So, just to finish
21:51up, I would say Docker sandboxes is
21:53really something you should be using on
21:55any machine where you want to confine an
21:59agent, whether that's a coding agent,
22:01which is the sort of most common
22:03examples that they're showing out there,
22:05but also custom agents. If you want to
22:08build a custom agent and you want to
22:10make sure that it's locked down, that
22:13you don't have to worry about it doing
22:15stuff. And the cool thing is just like I
22:16showed you there, I can have that deep
22:19agents agent just talking to LM Studio,
22:22so it can still use the local model
22:24that's on my machine. I could give it
22:27access to something like Tavily or to
22:30DuckDuckGo search. I could give it
22:32access to certain websites that I wanted
22:34to pull information from, and I could
22:36just run that 24/7 not having to worry
22:40about is this going off the rails and
22:43suddenly starting to wipe things on my
22:45drive or running up a huge bill, etc.
22:48Because in that case, the model would be
22:50totally local, etc. So, we all know that
22:53security is a key issue with agents.
22:56This basically just solves a lot of the
22:59problems in a very simple and elegant
23:02way that you can use for a variety of
23:05different things, whether that's coding
23:06agents, whether that's your own agents,
23:09etc. So, let me know in the comments if
23:10you've checked this out. All the links
23:12for all of this will be in the
23:13description. It's very easy to set up.
23:15You can try it out yourself. And let me
23:18know in the comments what you think.
23:19Anyway, as always, if you like the
23:21video, please click like and subscribe,
23:23and I will talk to you in the next
23:24video. Bye for now.

About this transcript

This page contains the full transcript of Docker Sandboxes - Safe and Secure Agents by Sam Witteveen, generated from the public captions YouTube serves with the video. The transcript has 4,421 words across 592 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.