YOLO Mode, Safely: MicroVM Sandboxes for Any Agent — Rowan Christmas, Docker

Hello everyone. Hello everyone. I hope you had a delicious I hope you had a delicious I hope you had a delicious lunch. I know this is lunch. I know this is lunch. I know this is one of the last one of the last one of the last reports of the reports of the reports of the conference. I conference. I conference. I tried to make it tried to make it tried to make it somewhat interesting and somewhat interesting and somewhat interesting and funny. So, you know, funny. So, you know, funny. So, you know, audience participation is audience participation is audience participation is encouraged. encouraged. encouraged. Let's see how it Let's see how it Let's see how it goes. So, I'm here from goes. So, I'm here from goes. So, I'm here from Docker. I'm one of the Docker. I'm one of the Docker. I'm one of the product managers product managers product managers working on our working on our working on our new new sandbox solution. I don't know sandbox solution. I don't know sandbox solution. I don't know if you've seen it yet. if you've seen it yet. if you've seen it yet. This is a new This is a new This is a new binary for Docker. It's binary for Docker. It's binary for Docker. It's called SBX. This is a called SBX. This is a called SBX. This is a micro virtual micro virtual micro virtual machine. She's really machine. She's really machine. She's really cool. You should cool. You should cool. You should come and take a look. come and take a look. come and take a look. But I will explain why But I will explain why But I will explain why you should you should you should use it in an use it in an use it in an agent context agent context agent context to manage and to manage and to manage and secure your secure your secure your agent platform. agent platform. You are all You are all using AI using AI using AI much more now than you would much more now than you would much more now than you would have expected 5 years have expected 5 years have expected 5 years ago. At least I am ago. At least I am . We usually . We usually . We usually think that think that think that our our our development environments protect us development environments protect us development environments protect us because if we because if we because if we try to do try to do try to do something wrong, they sometimes something wrong, they sometimes something wrong, they sometimes stop us. And when stop us. And when stop us. And when we hear stories like this we hear stories like this , we think, "Oh my God, I , we think, "Oh my God, I , we think, "Oh my God, I would never make the would never make the would never make the mistake of having mistake of having mistake of having my AI delete a my AI delete a my AI delete a productive productive productive database." "I've been database." "I've been database." "I've been programming for 30 years.

programming for 30 years. " "There's no way I would " "There's no way I would " "There's no way I would do that." So I do that." So I do that." So I decided to find out, " decided to find out, " decided to find out, " What if I What if I What if I try to hack try to hack try to hack myself?" "How far can I myself?" "How far can I myself?" "How far can I go with our go with our go with our tools in tools in tools in what is considered a what is considered a what is considered a safe safe safe environment?" I environment?" I environment?" I opened Claude Code on opened Claude Code on opened Claude Code on my my my desktop on my Mac. I desktop on my Mac. I desktop on my Mac. I asked him to find asked him to find asked him to find my my my browser history. He found browser history. He found browser history. He found her right away, which her right away, which her right away, which really impressed me. I really impressed me. I really impressed me. I asked, "What can I asked, "What can I asked, "What can I do about it?" We do about it?" We do about it?" We started looking at started looking at started looking at my bank my bank my bank accounts, which accounts, which accounts, which surprised me. He surprised me. He surprised me. He found them, which made me found them, which made me found them, which made me very unhappy. I very unhappy. I very unhappy. I made up fake made up fake made up fake bank names. This is not bank names. This is not bank names. This is not my real data, just so my real data, just so my real data, just so you know. But he did you know. But he did you know. But he did find all find all find all my real my real my real bank details. And bank details. And bank details. And he went even further. He he went even further. He he went even further. He discovered that I had discovered that I had discovered that I had recently ordered recently ordered recently ordered checks and used checks and used checks and used Zelle. He gave me the Zelle. He gave me the Zelle. He gave me the last four digits of last four digits of last four digits of the account I was the account I was the account I was using. I was using. I was using. I was very impressed. Here's a very impressed. Here's a very impressed. Here's a rough idea rough idea rough idea of ​​all the of ​​all the of ​​all the confidential confidential confidential information he found. This is again information he found. This is again information he found. This is again data from the data from the Claude desktop application, which we considered Claude desktop application, which we considered safe. In safe. In any case, maybe there is a any case, maybe there is a any case, maybe there is a better solution, who better solution, who better solution, who knows? So, the knows? So, the knows? So, the next day I next day I next day I came in and my came in and my came in and my security sent security sent security sent me such a sweet me such a sweet me such a sweet message that they message that they message that they thought I had been thought I had been thought I had been hacked. I hacked. I hacked. I had to explain to had to explain to had to explain to them that no, no, no, I was them that no, no, no, I was them that no, no, no, I was just preparing to just preparing to just preparing to speak at this speak at this speak at this conference. And conference. And conference. And please don't mark please don't mark please don't mark me as a me as a me as a compromised compromised compromised computer. Then

computer. Then computer. Then they sent me the they sent me the they sent me the CrowdStrike report about it, which is what CrowdStrike report about it, which is what CrowdStrike report about it, which is what I asked them for. I I asked them for. I I asked them for. I was quite impressed with was quite impressed with was quite impressed with him. It turns out that this is a him. It turns out that this is a him. It turns out that this is a known way to known way to known way to obtain obtain obtain credentials from a computer. I did credentials from a computer. I did credentials from a computer. I did n't know that. And I n't know that. And I n't know that. And I got a high score for it got a high score for it got a high score for it . I got a nine . I got a nine . I got a nine out of 10, which is better than I out of 10, which is better than I out of 10, which is better than I had in most had in most had in most classes. So, that was classes. So, that was classes. So, that was actually really good. actually really good. actually really good. But, fortunately, it was But, fortunately, it was But, fortunately, it was just my internal just my internal just my internal matter. This was not matter. This was not matter. This was not any interference any interference any interference through a script, MCP through a script, MCP server, or anything else server, or anything else server, or anything else that could easily have that could easily have that could easily have happened. So, it happened. So, it happened. So, it only took only took only took five requests. I five requests. I five requests. I had to be a little had to be a little had to be a little crafty. I couldn't...If crafty. I couldn't...If crafty. I couldn't...If you had just asked you had just asked you had just asked directly, "Hey, Claude, directly, "Hey, Claude, directly, "Hey, Claude, find my find my find my bank details." This, well, it will bank details." This, well, it will bank details." This, well, it will give you a give you a give you a warning. But warning. But warning. But if you say, "I'm if you say, "I'm if you say, "I'm researching researching researching security issues." He will be happy to security issues." He will be happy to security issues." He will be happy to help you help you help you conduct this conduct this conduct this research on your research on your research on your account. He's not, well, account. He's not, well, account. He's not, well, he's not your friend. So, he's not your friend. So, he's not your friend. So, if there was a better if there was a better if there was a better way to do this using way to do this using isolated micro VM technology, isolated micro VM technology, which which which Docker and others have recently released Docker and others have recently released . So instead of . So instead of . So instead of just saying " just saying " please," which, you please," which, you please," which, you know, if know, if know, if you look at some of you look at some of you look at some of Claude's prompts, you'll Claude's prompts, you'll Claude's prompts, you'll see. "Please do see. "Please do n't do anything n't do anything n't do anything bad, okay?" This is the bad, okay?" This is the bad, okay?" This is the level of security level of security level of security we are at now.

we are at now. we are at now. Now we have a micro-VM Now we have a micro-VM ; if you don't know what it is ; if you don't know what it is ; if you don't know what it is , compared to , compared to , compared to Docker, which you've all Docker, which you've all Docker, which you've all probably probably probably been using for years. been using for years. been using for years. The new thing that we and The new thing that we and The new thing that we and others are doing now others are doing now is micro VMs, they is micro VMs, they is micro VMs, they run their own run their own run their own kernel, they isolate kernel, they isolate kernel, they isolate your file system. your file system. your file system. We have a system that We have a system that We have a system that ensures that the ensures that the ensures that the sandbox will never sandbox will never sandbox will never see your see your see your secrets. When you secrets. When you secrets. When you try to make a try to make a try to make a network request, it network request, it network request, it takes the placeholder, takes the placeholder, takes the placeholder, replaces it so that replaces it so that replaces it so that your sandbox and your sandbox and your sandbox and agent can't agent can't agent can't do anything do anything do anything wrong. We have a wrong. We have a wrong. We have a complete audit complete audit complete audit trail for this. So, trail for this. So, trail for this. So, yes. We want to be, yes. We want to be, yes. We want to be, you want to be you want to be you want to be confident in safety confident in safety confident in safety from the start, from the start, from the start, not just not just not just hoping for the best hoping for the best hoping for the best and saying " and saying " and saying " please" waiting for something please" waiting for something please" waiting for something to happen. We're to happen. We're to happen. We're trying to find trying to find trying to find that balance, aren't we? that balance, aren't we? that balance, aren't we? If we can't, If we can't, If we can't, if we don't actually if we don't actually if we don't actually do these things, the do these things, the do these things, the agent will be useless. agent will be useless. agent will be useless. That's why this whole That's why this whole That's why this whole sandbox idea fascinates us so much sandbox idea fascinates us so much sandbox idea fascinates us so much . We . We . We encourage you encourage you encourage you to use it. Uh, and you to use it. Uh, and you to use it. Uh, and you probably know, don't probably know, don't probably know, don't let your let your let your bank details bank details bank details fall into the hands of fall into the hands of fall into the hands of your agent. This, this is your agent. This, this is your agent. This, this is not what you not what you not what you need at all. So, here's what need at all. So, here's what need at all. So, here's what it looks like in it looks like in it looks like in practice when you practice when you practice when you run the sandbox run the sandbox . Uh, on the left side— . Uh, on the left side— this is when I launch this is when I launch this is when I launch Claude. And on the right side — when Claude. And on the right side — when I do SBX run I do SBX run I do SBX run Claude. And you can Claude. And you can Claude. And you can see that there are, uh, see that there are, uh, see that there are, uh, a lot of differences.

a lot of differences. a lot of differences. This is a joke, sorry, they do This is a joke, sorry, they do This is a joke, sorry, they do n't exist. It's, uh, just n't exist. It's, uh, just permission bypass enabled, but permission bypass enabled, but nothing else, uh, complicated nothing else, uh, complicated nothing else, uh, complicated was going on, right? Running was going on, right? Running was going on, right? Running this command this command this command on the right automatically on the right automatically on the right automatically creates a new creates a new creates a new virtual machine, virtual machine, virtual machine, deploys it to this deploys it to this deploys it to this folder, and creates a folder, and creates a folder, and creates a new sandbox for you. new sandbox for you. new sandbox for you. It launches your It launches your It launches your agent. Now you are agent. Now you are agent. Now you are ready to go, he does ready to go, he does ready to go, he does n't see anything. n't see anything. n't see anything. So, if we So, if we So, if we try to perform a try to perform a browser history attack on browser history attack on regular Claude, it regular Claude, it regular Claude, it happily finds your happily finds your happily finds your browser history. But browser history. But browser history. But if I run this in the if I run this in the if I run this in the sandboxed version, sandboxed version, sandboxed version, it doesn't even think it doesn't even think it doesn't even think that you have a browser installed on your machine that you have a browser installed on your machine that you have a browser installed on your machine . . . So, pretty cool. So, pretty cool. So, pretty cool. No difference. I No difference. I No difference. I had to press had to press had to press seven more keys seven more keys seven more keys to get here, but I to get here, but I to get here, but I think that's a price think that's a price think that's a price worth paying. The worth paying. The worth paying. The same applies to same applies to same applies to network inbound network inbound network inbound and outbound traffic. and outbound traffic. and outbound traffic. This is where I tried to This is where I tried to This is where I tried to get him to go to get him to go to get him to go to The Pirate Bay because I knew The Pirate Bay because I knew The Pirate Bay because I knew it would be blocked. it would be blocked. it would be blocked. And indeed, it And indeed, it And indeed, it is blocked by is blocked by is blocked by default.

default. default. Another thing to Another thing to Another thing to notice, maybe notice, maybe notice, maybe hard to see, but hard to see, but hard to see, but Claude really likes to Claude really likes to Claude really likes to send a lot of send a lot of send a lot of telemetry telemetry telemetry to his Data Dog instance. to his Data Dog instance. to his Data Dog instance. So if you So if you So if you use Claude, use Claude, use Claude, you're sending you're sending you're sending a lot of your data to Anthropic, a lot of your data to Anthropic, a lot of your data to Anthropic, unless you're unless you're unless you're using using using sandboxes, in which sandboxes, in which sandboxes, in which case they're cleverly case they're cleverly case they're cleverly blocked. Another thing blocked. Another thing blocked. Another thing I will say about I will say about I will say about sandboxes is that they are very sandboxes is that they are very sandboxes is that they are very easy to easy to easy to use. Every use. Every use. Every developer in Docker now developer in Docker now developer in Docker now writes all their code in writes all their code in writes all their code in sandboxes. So we sandboxes. So we sandboxes. So we use it use it use it every day. We write every day. We write every day. We write all our code in this. all our code in this. all our code in this. If we don't If we don't If we don't do this, we'll, uh, do this, we'll, uh, do this, we'll, uh, get scolded. So, it is worth get scolded. So, it is worth get scolded. So, it is worth our time our time our time to do this. to do this. to do this. Small Small Small default settings default settings default settings . All of this . All of this . All of this can be customized. can be customized. can be customized. So, now that we've So, now that we've So, now that we've talked about talked about talked about why this is important, right? why this is important, right? why this is important, right? Attempts to do this at the Attempts to do this at the Attempts to do this at the highest level are not highest level are not highest level are not very effective. very effective. very effective. Agents find a Agents find a Agents find a way around this. way around this. way around this. If it reaches If it reaches If it reaches your host machine, it's too your host machine, it's too your host machine, it's too late. So you late. So you late. So you want to be at the want to be at the want to be at the microVM boundary level. We believe this is the microVM boundary level. We believe this is the best best best way. Other people way. Other people way. Other people think so too. And it's think so too. And it's think so too. And it's easy to easy to easy to use.

use. If you work in If you work in consulting, if you're, you consulting, if you're, you consulting, if you're, you know, a know, a know, a security director, or you work security director, or you work security director, or you work with clients, with clients, with clients, whatever it is, whatever it is, whatever it is, you probably you probably you probably deal with this every day. deal with this every day. deal with this every day. So you want not only the So you want not only the So you want not only the benefits of this, but also benefits of this, but also benefits of this, but also the ability to do the ability to do the ability to do things and let things and let things and let your agents your agents your agents perform different perform different perform different tasks, right? tasks, right? tasks, right? So one of the things So one of the things So one of the things that we're really excited about that we're really excited about is tracking is tracking agent-level identity and agent-level identity and delegation chains delegation chains . So you can start . So you can start . So you can start asking, "Hey, why did this asking, "Hey, why did this asking, "Hey, why did this happen?" And you can happen?" And you can happen?" And you can go back and go back and go back and say, "Oh, that's because an say, "Oh, that's because an say, "Oh, that's because an agent did it, and agent did it, and agent did it, and the person actually the person actually the person actually authorized that authorized that authorized that agent to do it." agent to do it." agent to do it." This didn't just happen This didn't just happen This didn't just happen by magic by magic by magic . We don't know . We don't know ...as if we don't know ...as if we don't know ...as if we don't know how it happened. Now how it happened. Now how it happened. Now we will start we will start we will start tracking this, tracking this, tracking this, reporting it to you, reporting it to you, reporting it to you, and allowing us to write and allowing us to write and allowing us to write policies that policies that policies that actually restrict actually restrict actually restrict what can be done what can be done what can be done based on Cedar policies and based on Cedar policies and based on Cedar policies and new developments. And you new developments. And you new developments. And you might say to yourself, " might say to yourself, " Oh my God, this is so cool. I Oh my God, this is so cool. I Oh my God, this is so cool. I wish, I wish I could wish, I wish I could wish, I wish I could buy this right now. How buy this right now. How buy this right now. How can I, how can I buy can I, how can I buy can I, how can I buy this from you?" So, I this from you?" So, I this from you?" So, I have my marketing have my marketing have my marketing slide that my slide that my slide that my marketing team is marketing team is marketing team is really mad at me for really mad at me for really mad at me for creating, but I creating, but I creating, but I think it's funny and think it's funny and think it's funny and cute for cute for cute for AI management. So let's definitely AI management. So let's definitely AI management. So let's definitely talk about it.

talk about it. talk about it. So, what does So, what does So, what does AI governance look like? Here's what AI governance look like? Here's what AI governance look like? Here's what it looks like in it looks like in it looks like in layout form. So now we layout form. So now we layout form. So now we are working with the network. are working with the network. are working with the network. You can You can You can set permission set permission set permission or prohibition. You or prohibition. You or prohibition. You can configure can configure can configure file file file system mount points. And you system mount points. And you system mount points. And you can also decide what can also decide what can also decide what your MCP catalog looks like your MCP catalog looks like your MCP catalog looks like . Additionally, if you . Additionally, if you . Additionally, if you run our run our run our MCP server, the MCP server, the MCP server, the MCP servers themselves run in a MCP servers themselves run in a MCP servers themselves run in a sandbox. So they are sandbox. So they are sandbox. So they are also governed by also governed by also governed by all these different all these different all these different controls. controls. controls. We will We will We will add more add more add more features in the future. One of the features in the future. One of the features in the future. One of the things that things that things that many many many people told us at this people told us at this people told us at this conference was the conference was the conference was the desire to set up desire to set up L7 network control. They want to L7 network control. They want to be able to be able to be able to control control control file system access for file system access for file system access for each each each GitHub repository, right? So GitHub repository, right? So GitHub repository, right? So you want your you want your you want your agent to be able to read and agent to be able to read and agent to be able to read and write data to write data to write data to some repositories or some repositories or some repositories or parts of them, parts of them, parts of them, but not to others, right? but not to others, right? but not to others, right? So, all of that will come So, all of that will come So, all of that will come later, but everything I later, but everything I later, but everything I showed you today is showed you today is showed you today is already working, and you already working, and you already working, and you should come to should come to should come to our booth to our booth to our booth to see it. This is easy see it. This is easy see it. This is easy to install. We to install. We to install. We work on Mac, Windows, and work on Mac, Windows, and work on Mac, Windows, and Linux, depending on Linux, depending on Linux, depending on your chosen your chosen your chosen package manager. And package manager. And package manager. And as you can see at the end, as you can see at the end, as you can see at the end, it's just SBX run cloud. By it's just SBX run cloud. By it's just SBX run cloud. By the way, it's not just a cloud the way, it's not just a cloud . Our sandboxes are . Our sandboxes are . Our sandboxes are full-fledged full-fledged full-fledged virtual machines.

virtual machines. virtual machines. So you can So you can So you can run a shell, run a shell, run a shell, codex, anything, a Python codex, anything, a Python script, or a web server script, or a web server —whatever you —whatever you —whatever you want, and we just want, and we just want, and we just want to make it as easy as possible want to make it as easy as possible want to make it as easy as possible for you to get for you to get for you to get started. This is started. This is started. This is our standard our standard our standard option so you can option so you can option so you can just get started just get started just get started and run your cloud and run your cloud and run your cloud code or codex instance. code or codex instance. code or codex instance. It feels like a It feels like a It feels like a native environment. native environment. native environment. It works just like what It works just like what It works just like what you saw you saw you saw today, but with all today, but with all today, but with all these built-in these built-in these built-in security features. security features. security features. Additionally, you can Additionally, you can Additionally, you can mount other mount other mount other file systems. So file systems. So file systems. So when I work on a when I work on a when I work on a piece of code with piece of code with piece of code with linked linked linked repositories, I repositories, I repositories, I mount them mount them mount them read-only. This way, read-only. This way, read-only. This way, my agent sees what I'm my agent sees what I'm my agent sees what I'm doing. It sees a doing. It sees a doing. It sees a different codebase, but different codebase, but different codebase, but I know it won't I know it won't I know it won't make random make random make random commits to third-party commits to third-party commits to third-party repositories just repositories just repositories just to make my to make my to make my program work, program work, program work, right? I want a right? I want a right? I want a guarantee that it guarantee that it guarantee that it really does what it really does what it really does what it claims and claims and claims and only works with the API I specify only works with the API I specify only works with the API I specify . So, that's all. . So, that's all. . So, that's all. Quite briefly. We Quite briefly. We Quite briefly. We have a stand. We have have a stand. We have have a stand. We have a few a few sunglasses and sunglasses and power banks left that we are power banks left that we are power banks left that we are giving away. Come giving away. Come giving away. Come by our booth, I'll by our booth, I'll by our booth, I'll come over after the come over after the come over after the show, show you a show, show you a show, show you a demo, and you'll demo, and you'll demo, and you'll look as look as look as cool as Macho Man cool as Macho Man cool as Macho Man Randy Savage in these Randy Savage in these Randy Savage in these glasses. That's it.

glasses. That's it. glasses. That's it. Thank you.