한국어

Sandboxing
AI Agents
on Ubuntu

Controlling boundaries with
Docker Sandboxes and Azure Container Apps Sandboxes

Justin Yoo Principal Developer Advocate Microsoft / GitHub Docker Captain
한국어
AI agents execute commands with my privileges,
much faster than I can.

So, how far should we allow the impact when agents make mistakes or get compromised?

한국어
Risks and Control Boundaries
How far should we allow the parameters of AI agents?
한국어

Potential Threats

rm
File Corruption

Deletion or overwriting of source, config, and home directories

key
Credentials

Exposure or misuse of tokens and cloud keys

net
Data Leakage

Transmission of code and data to unauthorized destinations

pkg
Supply Chain

Execution of malicious packages and installation scripts

docker.sock
Host Takeover

Access to Docker sockets and local processes

한국어
Docker Sandboxes comes for rescue
Agent Capabilities

File modification, shell execution, package installation, and network access are necessary

Isolated Execution Boundary

Perform necessary tasks within a microVM isolated from the host

Maintain necessary privileges, but limit the impacting parameters.
한국어

Grant privileges inside, enforce boundaries outside

01
Compute

Separate kernel and process boundaries

02
Files

Sharing scope and write permissions

03
Network

Destination-based egress policies

04
Credentials

Proxy injection with plaintext hidden

05
Lifecycle

Automation of creation, suspension, and termination

한국어

Security Architecture

AI Agent · sudo · packages · Internal Docker Engine
microVM · Kernel isolation · Primary trust boundary
Host OS · Host filesystem · Host Docker daemon · Local processes
WorkspaceExplicitly shared
Host ProxyPolicies and credentials
Allowed NetworkAllowed destinations only
한국어

Direct 🤜🤛 Clone

Direct Mode

  • Mount projects with read-write access
  • Changes immediately reflect on the host
  • Fast iteration, low code isolation

Clone Mode

  • Original repository is read-only
  • Work on a private copy inside the VM
  • Selectively merge changes after review

In Direct Mode, even with sandboxes, projects stored on the host are affected.

한국어
DEMO #1
Modernizing .NET Apps
in Docker Sandboxes
한국어

Demo #1: Modernizing .NET Apps in Docker Sandboxes

  • Run GitHub Copilot CLI in a Docker Sandbox
  • Install the GitHub Copilot modernization plugin
  • The modernize agent orchestrates diagnosis, planning, and execution
  • Cannot access files not shared with the host Docker daemon
  • Review changes and policy logs from private clones
한국어

Demo #1: Modernizing .NET Apps in Docker Sandboxes

sbx secret set github --command 'gh auth token'
sbx run --clone --name dotnet-appmod copilot .
sbx exec -it dotnet-appmod bash
AuthenticateInject token via host proxy
RunSandbox + Copilot CLI
ShellAccess for installation and status checks
한국어

Demo #1: Modernizing .NET Apps in Docker Sandboxes

/plugin marketplace add microsoft/github-copilot-modernization
/plugin install github-copilot-modernization@github-copilot-modernization
한국어

Demo #1: Modernizing .NET Apps in Docker Sandboxes

copilot/agentgithub-copilot-modernization:modernize
AssessmentAnalyze dependencies, .NET, and risks
PlanningCreate actionable task plans
ExecutionModify, build, and validate
assessment/

Modernization assessment results

plan.md · tasks.json

Reviewable execution plans

task commits

Change history per task

한국어

Demo #1: Modernizing .NET Apps in Docker Sandboxes

Modernize this application
Modernize this app to .NET 10
한국어
We've executed it safely in a local machine.
Now, how do we operate it at team and service scale?
Machine Dependency

Dependent on developer machine's status and availability

Lifecycle Automation

Need automated interfaces for creation, suspension, and termination on demand

Concurrent Execution

Isolated operation of multiple users and agents

한국어
From Local to Cloud
Scaling lifecycle and capacity
with Azure Container Apps Sandboxes
한국어

What if we move sandboxes to the cloud?

ACA CLIPortal · SDK · Bicep · Skills
Sandbox GroupPolicies, images, networking
SandboxIsolated stateful execution
SnapshotMemory and disk

Microsoft.App/SandboxGroups · Azure Container Apps Sandboxes

한국어
< 1s
Fast Startup

Sub-second provisioning using pre-warmed pools

Massive Scaling

Zero-to-Scale · Scale from zero to thousands of concurrent sandboxes

⏸︎ ▶︎
Suspend / Resume

Preserve state during idle periods and resume quickly

ID
Azure Governance

Entra ID, RBAC, Azure resource boundaries

VNet
Networking

Ingress and egress policies with virtual network integration

OCI
Custom Images

Use pre-configured toolchains as root filesystems

한국어
DEMO #2
Using Copilot CLI
in ACA Sandboxes
한국어

Demo #2: Using Copilot CLI in ACA Sandboxes

1 · Prepare Sandbox Group

aca sandboxgroup create \
  --name ghcp-sandbox-demo \
  --location koreacentral \
  --set-config

2 · Create Sandbox

aca sandbox create \
  --disk copilot \
  --credential <copilot-credential-id> \
  --label name=ghcp-demo
Sandbox Group Configuration Saved Sandbox ID · Running
한국어

Demo #2: Using Copilot CLI in ACA Sandboxes

$ aca sandbox shell -l name=ghcp-demo

workspaces$ git clone https://github.com/devkimchi/battle-school-lunch.git
workspaces$ cd battle-school-lunch
workspaces$ copilot
Clone Move to Working Directory Run Copilot CLI
한국어

Demo #2: Using Copilot CLI in ACA Sandboxes

I want to change this project's Web UI to Brutal Design style. Don't modify the code, just write the change plan to a design-update.md file
한국어

Demo #2: Using Copilot CLI in ACA Sandboxes

1 · Suspend

aca sandbox stop \
  -l name=ghcp-demo

2 · Resume

aca sandbox resume \
  -l name=ghcp-demo
  • Resume with the same sandbox ID and execution context
  • Verify the design-update.md file is preserved
  • No CPU or memory computing costs while suspended
한국어
What to choose and
What to defend
Product selection criteria and remaining risks
한국어

Docker Sandboxes 🤜🤛 ACA Sandboxes

CriteriaDocker SandboxesACA Sandboxes
Primary UsersIndividual developersTeams, services, multi-tenant
Execution LocationLocal PCAzure-managed infrastructure
Creation MethodsInteractive CLIPortal · CLI · SDK · Bicep · Skills
State LifecycleLocal persistencesnapshot · suspend · resume
Massive ConcurrencyMachine capacity limitsScale to thousands
한국어

Risks remain even with sandboxes

Network and Credentials

Information can be leaked to allowed destinations or granted privileges misused

Supply Chain Attacks

Malicious packages, plugins, images, and installation scripts can be executed

Generated Content Contamination

Code, build scripts, and CI configurations must be reviewed before external execution

External Tool Trust

MCP servers, Skills, and external APIs represent separate trust boundaries

한국어

Risks remain even with sandboxes

Docker Sandboxes

Direct Mode

Changes to shared workspaces immediately affect the host

Host Integration

Local stdio MCP and shared Skills connect to host resources outside the microVM

ACA Sandboxes

RBAC and Tenant Isolation

Errors in role scope or user-to-sandbox mapping can expose privileges

Residual State Data

Code, logs, and sensitive data can remain in snapshots and volumes

한국어
Sandboxes don't
guarantee for security
on
AI coding agents like GitHub Copilot.
Instead, they add a defense layer that minimizes risks
한국어

Key Takeaways

1

Grant agents the privileges they need, but enforce boundaries from outside.

2

Use Docker Sandboxes for interactive execution on developer PCs, and ACA Sandboxes for remote automation and multi-execution.

3

Sandboxes make troubles small, observable, and disposable.

한국어

Want to learn more about sandboxes?

Docker Sandboxes Security Modeldocs.docker.com/ai/sandboxes/security
Running GitHub Copilot CLI in Docker Sandboxesdocs.docker.com/ai/sandboxes/agents/copilot
Modernizing Java Apps with Copilot CLIaka.ms/ghcp/appmod/java
Modernizing .NET Apps with Copilot CLIaka.ms/ghcp/appmod/dotnet
Azure Container Apps Sandboxes Introductionaka.ms/aca/sandboxes
Azure Container Apps Sandboxes Documentationsandboxes.azure.com/docs
한국어
Thank You
Sandboxing AI Agents on Ubuntu
Justin Yoo| Principal Developer Advocate| Microsoft/GitHub| Docker Captain| GitHub @justinyoo| LinkedIn @justinyoo

Speaker Notes · 00:00–01:00 · 1 minute - Self-introduction - Have you ever experienced an AI coding agent like GitHub Copilot suddenly deleting directories? - AI agents often behave in unexpected ways. We need to ensure we can use them safely even in such situations - Today, let's discuss the sandbox features

Speaker Notes · 01:00–02:00 · 1 minute - When GitHub Copilot first came out, it was only at the level of suggesting code - Now it directly modifies files, installs packages, executes shell commands, and accesses the network - As coding agents improve, they can use my PC's privileges however they want - There's plenty of potential for problems, but if we don't grant privileges, the constraints are too restrictive - If we grant privileges and something goes wrong, how far should we allow the scope of damage?

Speaker Notes · 02:00–02:10 · 10 seconds - What are the potential risks that a coding agent can create in a local development environment, and what boundaries should we establish to control them?

Speaker Notes · 02:10–04:10 · 2 minutes - We can categorize about five types of risks - Unwanted files can be touched - Tokens in environment variables or config files can be read - Information can be leaked through connected networks - Supply chain attacks through malicious package installation - Possibility of host takeover through Docker sockets - So, can we control these risks?

Speaker Notes · 04:10–04:40 · 30 seconds - If we remove agent privileges to control these risks, they won't be able to do their work - That's why Docker Sandboxes were created - Agents maintain all necessary privileges within a microVM - At the same time, they cannot access files and resources not shared by the host

Speaker Notes · 04:40–06:00 · 1 minute 20 seconds - Sandboxes are more like VMs than simple containers - Agents inside can have sufficient privileges including sudo - However, they cannot access host files, have limited network access, secrets are provided via proxy from the host, and the sandbox lifecycle is managed by the host - This way, we can implement both autonomy and control simultaneously

Speaker Notes · 06:00–07:30 · 1 minute 30 seconds - The basic boundary of a sandbox is the microVM - Inside, agents have high privileges but cannot access the host until the host shares resources - Cannot access the host's Docker daemon. Sandboxes use their internal Docker engine - In other words, sandboxes only communicate with the outside through predetermined channels

Speaker Notes · 07:30–09:00 · 1 minute 30 seconds - Docker Sandboxes offer two code access principles - Direct Mode and Clone Mode both have pros and cons - Direct Mode shares the project with the host. Fast reflection is possible. But isolation is lower - Clone Mode doesn't share the project with the host. Code changes must be handled via PR. Higher isolation is possible

Speaker Notes · 09:00–09:10 · 10 seconds - Let's see the first demo - We'll modernize the app using GitHub Copilot CLI and the app modernization plugin within a Docker Sandbox

Speaker Notes · 09:10–09:50 · 40 seconds - In this demo, we'll show these things - App modernization itself is important, but it's crucial to see that it only runs within the sandbox

Speaker Notes · 09:50–11:10 · 1 minute 20 seconds - Store the GitHub token as a host secret - Then open a sandbox in clone mode and immediately run the GitHub Copilot CLI - Or enter the sandbox bash shell via the sbx exec command

Speaker Notes · 11:10–12:10 · 1 minute - Install the plugin - Related MCP servers are also installed during plugin installation - MCP execution failures are due to sandbox environment configuration

Speaker Notes · 12:10–13:40 · 1 minute 30 seconds - After running /agent, select github-copilot-modernization:modernize - The modernization agent automatically proceeds through Assessment, Planning, and Execution stages - GitHub Copilot already automatically applies the --allow-all option, leaving only the confirmation at the end

Speaker Notes · 13:40–17:00 · 3 minutes 20 seconds - Execute the prompt - You can say it as shown on screen, or simply say "do it!" - Here we asked it to modernize to .NET 10 - This takes time, so we'll show progress and move on to the next

Speaker Notes · 17:00–17:30 · 30 seconds - So far we've shown the process of app modernization with GitHub Copilot CLI in Docker Sandboxes - But what if we need to run many tasks simultaneously at the team level? We can't rely on individual developer PCs - From here on, we need to consider sandboxes running in the cloud - ACA Sandboxes can solve this problem

Speaker Notes · 17:30–17:40 · 10 seconds - Beyond local development environment isolation, let's operate sandboxes at cloud scale

Speaker Notes · 17:40–19:00 · 1 minute 20 seconds - ACA Sandboxes are Container Apps-based resources. Currently in preview - You can create and manage sandboxes via Portal, CLI, Python SDK, Skills, etc. - Today we'll use the ACA CLI - Each sandbox is an isolated execution environment using container images from Docker as the root filesystem - Each sandbox provides snapshots so you can suspend containers when not in use and resume them when needed

Speaker Notes · 19:00–20:20 · 1 minute 20 seconds - In addition to Docker Sandboxes running locally, ACA Sandboxes offer these advantages - Fast startup, scaling, snapshots, cloud governance, network control, custom OCI images - No costs accrue for suspended sandboxes except for snapshot storage - Sandbox users require separate RBAC permissions

Speaker Notes · 20:20–20:30 · 10 seconds - Now, let's see the second demo

Speaker Notes · 20:30–21:30 · 1 minute - Create a sandbox group with the aca sandboxgroup create command - all sandboxes run here - Create a sandbox with the aca sandbox create command - You can log in within the sandbox, or pre-login using GitHub PAT before entering - Then you can enter the sandbox

Speaker Notes · 21:30–22:30 · 1 minute - Enter the sandbox with the aca sandbox shell command - Clone a GitHub repo and run the GitHub Copilot CLI

Speaker Notes · 22:30–23:30 · 1 minute - Execute the prompt

Speaker Notes · 23:30–24:30 · 1 minute - Suspend the sandbox with the aca sandbox stop command - Resume the sandbox with the aca sandbox resume command - Verify the design-update.md file is still there

Speaker Notes · 24:30–24:40 · 10 seconds - But is a sandbox really a silver bullet from a security perspective? There are still things to be careful about

Speaker Notes · 24:40–25:40 · 1 minute - For developers to safely use agents locally, Docker Sandboxes are natural - For remotely running multiple sandboxes dynamically and automatically, ACA Sandboxes are natural

Speaker Notes · 25:40–26:40 · 1 minute - Risks still remain - Network and tokens can be pathways for information leakage and privilege misuse - Supply chain attacks, plugins, installation scripts, etc. require separate review - Sandboxes limit the scope of impact from these risks

Speaker Notes · 26:40–27:40 · 1 minute - For Docker Sandboxes: be careful with Direct Mode, local MCP running outside the sandbox, and shared Skills - For ACA Sandboxes: properly control RBAC permissions - Snapshots have the advantage of preserving working state, but data persists so lifecycle management requires care

Speaker Notes · 27:40–28:00 · 20 seconds - Therefore, sandboxes are not devices that unconditionally make AI coding agents like GitHub Copilot safe - Rather, they're a defense layer that minimizes damage if problems occur

Speaker Notes · 28:00–29:00 · 1 minute - Today's session content can be summarized in three ways - 1. Grant agents work privileges but enforce execution boundaries through external policies - 2. Use Docker Sandboxes for interactive execution of GitHub Copilot CLI on developer PCs, and ACA Sandboxes for remote automation and multi-execution - 3. Sandboxes make blast radius small, observable, and disposable

Speaker Notes · 29:00–29:20 · 20 seconds - If you want to learn more about sandboxes, check out these links

Speaker Notes · 29:20–30:00 · 40 seconds - Thank you very much!