Speaker Notes · 00:00–01:00 · 1 minute - Self-introduction - Have you ever experienced an AI coding agent like GitHub Copilot suddenly deleting directories? - AI agents often behave in unexpected ways. We need to ensure we can use them safely even in such situations - Today, let's discuss the sandbox features
Speaker Notes · 01:00–02:00 · 1 minute - When GitHub Copilot first came out, it was only at the level of suggesting code - Now it directly modifies files, installs packages, executes shell commands, and accesses the network - As coding agents improve, they can use my PC's privileges however they want - There's plenty of potential for problems, but if we don't grant privileges, the constraints are too restrictive - If we grant privileges and something goes wrong, how far should we allow the scope of damage?
Speaker Notes · 02:00–02:10 · 10 seconds - What are the potential risks that a coding agent can create in a local development environment, and what boundaries should we establish to control them?
Speaker Notes · 02:10–04:10 · 2 minutes - We can categorize about five types of risks - Unwanted files can be touched - Tokens in environment variables or config files can be read - Information can be leaked through connected networks - Supply chain attacks through malicious package installation - Possibility of host takeover through Docker sockets - So, can we control these risks?
Speaker Notes · 04:10–04:40 · 30 seconds - If we remove agent privileges to control these risks, they won't be able to do their work - That's why Docker Sandboxes were created - Agents maintain all necessary privileges within a microVM - At the same time, they cannot access files and resources not shared by the host
Speaker Notes · 04:40–06:00 · 1 minute 20 seconds - Sandboxes are more like VMs than simple containers - Agents inside can have sufficient privileges including sudo - However, they cannot access host files, have limited network access, secrets are provided via proxy from the host, and the sandbox lifecycle is managed by the host - This way, we can implement both autonomy and control simultaneously
Speaker Notes · 06:00–07:30 · 1 minute 30 seconds - The basic boundary of a sandbox is the microVM - Inside, agents have high privileges but cannot access the host until the host shares resources - Cannot access the host's Docker daemon. Sandboxes use their internal Docker engine - In other words, sandboxes only communicate with the outside through predetermined channels
Speaker Notes · 07:30–09:00 · 1 minute 30 seconds - Docker Sandboxes offer two code access principles - Direct Mode and Clone Mode both have pros and cons - Direct Mode shares the project with the host. Fast reflection is possible. But isolation is lower - Clone Mode doesn't share the project with the host. Code changes must be handled via PR. Higher isolation is possible
Speaker Notes · 09:00–09:10 · 10 seconds - Let's see the first demo - We'll modernize the app using GitHub Copilot CLI and the app modernization plugin within a Docker Sandbox
Speaker Notes · 09:10–09:50 · 40 seconds - In this demo, we'll show these things - App modernization itself is important, but it's crucial to see that it only runs within the sandbox
Speaker Notes · 09:50–11:10 · 1 minute 20 seconds - Store the GitHub token as a host secret - Then open a sandbox in clone mode and immediately run the GitHub Copilot CLI - Or enter the sandbox bash shell via the sbx exec command
Speaker Notes · 11:10–12:10 · 1 minute - Install the plugin - Related MCP servers are also installed during plugin installation - MCP execution failures are due to sandbox environment configuration
Speaker Notes · 12:10–13:40 · 1 minute 30 seconds - After running /agent, select github-copilot-modernization:modernize - The modernization agent automatically proceeds through Assessment, Planning, and Execution stages - GitHub Copilot already automatically applies the --allow-all option, leaving only the confirmation at the end
Speaker Notes · 13:40–17:00 · 3 minutes 20 seconds - Execute the prompt - You can say it as shown on screen, or simply say "do it!" - Here we asked it to modernize to .NET 10 - This takes time, so we'll show progress and move on to the next
Speaker Notes · 17:00–17:30 · 30 seconds - So far we've shown the process of app modernization with GitHub Copilot CLI in Docker Sandboxes - But what if we need to run many tasks simultaneously at the team level? We can't rely on individual developer PCs - From here on, we need to consider sandboxes running in the cloud - ACA Sandboxes can solve this problem
Speaker Notes · 17:30–17:40 · 10 seconds - Beyond local development environment isolation, let's operate sandboxes at cloud scale
Speaker Notes · 17:40–19:00 · 1 minute 20 seconds - ACA Sandboxes are Container Apps-based resources. Currently in preview - You can create and manage sandboxes via Portal, CLI, Python SDK, Skills, etc. - Today we'll use the ACA CLI - Each sandbox is an isolated execution environment using container images from Docker as the root filesystem - Each sandbox provides snapshots so you can suspend containers when not in use and resume them when needed
Speaker Notes · 19:00–20:20 · 1 minute 20 seconds - In addition to Docker Sandboxes running locally, ACA Sandboxes offer these advantages - Fast startup, scaling, snapshots, cloud governance, network control, custom OCI images - No costs accrue for suspended sandboxes except for snapshot storage - Sandbox users require separate RBAC permissions
Speaker Notes · 20:20–20:30 · 10 seconds - Now, let's see the second demo
Speaker Notes · 20:30–21:30 · 1 minute - Create a sandbox group with the aca sandboxgroup create command - all sandboxes run here - Create a sandbox with the aca sandbox create command - You can log in within the sandbox, or pre-login using GitHub PAT before entering - Then you can enter the sandbox
Speaker Notes · 21:30–22:30 · 1 minute - Enter the sandbox with the aca sandbox shell command - Clone a GitHub repo and run the GitHub Copilot CLI
Speaker Notes · 22:30–23:30 · 1 minute - Execute the prompt
Speaker Notes · 23:30–24:30 · 1 minute - Suspend the sandbox with the aca sandbox stop command - Resume the sandbox with the aca sandbox resume command - Verify the design-update.md file is still there
Speaker Notes · 24:30–24:40 · 10 seconds - But is a sandbox really a silver bullet from a security perspective? There are still things to be careful about
Speaker Notes · 24:40–25:40 · 1 minute - For developers to safely use agents locally, Docker Sandboxes are natural - For remotely running multiple sandboxes dynamically and automatically, ACA Sandboxes are natural
Speaker Notes · 25:40–26:40 · 1 minute - Risks still remain - Network and tokens can be pathways for information leakage and privilege misuse - Supply chain attacks, plugins, installation scripts, etc. require separate review - Sandboxes limit the scope of impact from these risks
Speaker Notes · 26:40–27:40 · 1 minute - For Docker Sandboxes: be careful with Direct Mode, local MCP running outside the sandbox, and shared Skills - For ACA Sandboxes: properly control RBAC permissions - Snapshots have the advantage of preserving working state, but data persists so lifecycle management requires care
Speaker Notes · 27:40–28:00 · 20 seconds - Therefore, sandboxes are not devices that unconditionally make AI coding agents like GitHub Copilot safe - Rather, they're a defense layer that minimizes damage if problems occur
Speaker Notes · 28:00–29:00 · 1 minute - Today's session content can be summarized in three ways - 1. Grant agents work privileges but enforce execution boundaries through external policies - 2. Use Docker Sandboxes for interactive execution of GitHub Copilot CLI on developer PCs, and ACA Sandboxes for remote automation and multi-execution - 3. Sandboxes make blast radius small, observable, and disposable
Speaker Notes · 29:00–29:20 · 20 seconds - If you want to learn more about sandboxes, check out these links
Speaker Notes · 29:20–30:00 · 40 seconds - Thank you very much!