--- title: Getting Started With Dev Containers (and Why They're Not... description: Dev containers give development teams a reproducible, shared toolchain, but they are not a secure sandbox for autonomous coding agents. They block unrestricted... canonical: https://daily.dev/posts/getting-started-with-dev-containers-and-why-they-re-not-a-perfect-sandbox--yipkrjwqf twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Getting Started With Dev Containers (and Why They're Not a Perfect Sandbox) | daily.dev og:description: Dev containers give development teams a reproducible, shared toolchain, but they are not a secure sandbox for autonomous coding agents. They block unrestricted... og:url: https://daily.dev/posts/getting-started-with-dev-containers-and-why-they-re-not-a-perfect-sandbox--yipkrjwqf og:image: https://api.daily.dev/og/posts/YIPkrjwQf.png og:image:alt: Getting Started With Dev Containers (and Why They're Not a Perfect Sandbox) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Getting Started With Dev Containers (and Why They're Not a Perfect Sandbox) **[marmelab](https://daily.dev/sources/Marmelab)** · 16 min read · 1 upvotes · 0 comments ## Summary Dev containers give development teams a reproducible, shared toolchain, but they are not a secure sandbox for autonomous coding agents. They block unrestricted host filesystem access, persistent malware and data loss, but they don't stop repository infection via prompt injection, data exfiltration, or Docker in Docker (DinD) escapes. Enabling DinD, Docker outside of Docker, or --privileged lets an attacker mount the host disk or spawn a container with -v /:/host to take over the host. Marmelab mitigates this by withholding git SSH keys from agents and plans a follow-up post on hardening Docker inside dev containers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Are VS Code dev containers safe to run autonomous coding agents like Claude Code in yolo mode? Only partially. Dev containers block unrestricted host filesystem access, persistent malware installation, and data loss, since you can just delete and recreate the container. However, they do not protect against repository infection via prompt injection, data exfiltration to external servers, or, critically, Docker in Docker escapes that can grant code execution on the host. _Anyone locking down an agent workflow can track dev container security findings like these on daily.dev._ ### Can an attacker escape a Docker in Docker (DinD) or privileged container to take over the host? Yes. DinD or privileged containers let an attacker mount the host disk, such as /dev/sda, or abuse capabilities and cgroups like release_agent to run code as host root. Docker outside of Docker (DooD), which mounts the host's docker.sock, lets an attacker spawn a container with -v /:/host and take over the host filesystem entirely, bypassing firewalls and credential isolation. _Teams weighing DinD against safer alternatives like Podman can follow this kind of container security analysis on daily.dev._ ### How can I let a coding agent run Docker Compose or E2E tests without exposing my host to a Docker in Docker escape? Options include rootless Podman as a drop-in Docker CLI replacement that needs no privileges, the Sysbox runtime which runs Docker inside a container without --privileged, or wrapping the whole dev container inside an actual VM for the strongest isolation. Each carries tradeoffs in setup complexity versus isolation strength, and a dedicated follow-up post covers what worked and failed in practice. _Developers hardening agent sandboxes around Docker can follow the upcoming hardening write-up on daily.dev._ ## Similar posts on daily.dev - [Docker Sandboxes and microVMs, explained](https://daily.dev/posts/docker-sandboxes-and-microvms-explained-ly8mg0oel) · InfoWorld · 17 upvotes · 0 comments - [The Questions Every Team Asks About Docker Sandboxes](https://daily.dev/posts/the-questions-every-team-asks-about-docker-sandboxes-dea3ny4vm) · Cloud Native Now · 0 upvotes · 0 comments - [6 Benefits of Sandbox Environments](https://daily.dev/posts/6-benefits-of-sandbox-environments-rud8ecsna) · Docker · 1 upvotes · 0 comments - [Docker runs containers with root privileges by default, and that's a bigger risk than most people realize](https://daily.dev/posts/docker-runs-containers-with-root-privileges-by-default-and-that-s-a-bigger-risk-than-most-people-re-fhiy5ojsk) · XDA Developers · 0 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#docker](https://daily.dev/tags/docker), [#containers](https://daily.dev/tags/containers), [#vscode](https://daily.dev/tags/vscode) [View this post on daily.dev](https://daily.dev/posts/getting-started-with-dev-containers-and-why-they-re-not-a-perfect-sandbox--yipkrjwqf) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Getting Started With Dev Containers (and Why They're Not a Perfect Sandbox)","url":"https://daily.dev/posts/getting-started-with-dev-containers-and-why-they-re-not-a-perfect-sandbox--yipkrjwqf","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/getting-started-with-dev-containers-and-why-they-re-not-a-perfect-sandbox--yipkrjwqf"},"datePublished":"2026-10-28T13:35:47.780Z","dateModified":"2026-10-28T15:00:08.419Z","description":"Dev containers give development teams a reproducible, shared toolchain, but they are not a secure sandbox for autonomous coding agents. They block unrestricted...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a6b73a0c20c481153248cff6e9e94d75?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a6b73a0c20c481153248cff6e9e94d75?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"marmelab","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"marmelab","logo":"https://media.daily.dev/image/upload/s--AeMXoaI9--/f_auto/v1716621144/logos/Marmelab","url":"https://daily.dev/sources/Marmelab"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/getting-started-with-dev-containers-and-why-they-re-not-a-perfect-sandbox--yipkrjwqf","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,docker,containers,vscode","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"marmelab","item":"https://daily.dev/sources/Marmelab"},{"@type":"ListItem","position":3,"name":"Getting Started With Dev Containers (and Why They're Not a Perfect Sandbox)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/getting-started-with-dev-containers-and-why-they-re-not-a-perfect-sandbox--yipkrjwqf#faq","mainEntity":[{"@type":"Question","name":"Are VS Code dev containers safe to run autonomous coding agents like Claude Code in yolo mode?","acceptedAnswer":{"@type":"Answer","text":"Only partially. Dev containers block unrestricted host filesystem access, persistent malware installation, and data loss, since you can just delete and recreate the container. However, they do not protect against repository infection via prompt injection, data exfiltration to external servers, or, critically, Docker in Docker escapes that can grant code execution on the host. Anyone locking down an agent workflow can track dev container security findings like these on daily.dev."}},{"@type":"Question","name":"Can an attacker escape a Docker in Docker (DinD) or privileged container to take over the host?","acceptedAnswer":{"@type":"Answer","text":"Yes. DinD or privileged containers let an attacker mount the host disk, such as /dev/sda, or abuse capabilities and cgroups like release_agent to run code as host root. Docker outside of Docker (DooD), which mounts the host's docker.sock, lets an attacker spawn a container with -v /:/host and take over the host filesystem entirely, bypassing firewalls and credential isolation. Teams weighing DinD against safer alternatives like Podman can follow this kind of container security analysis on daily.dev."}},{"@type":"Question","name":"How can I let a coding agent run Docker Compose or E2E tests without exposing my host to a Docker in Docker escape?","acceptedAnswer":{"@type":"Answer","text":"Options include rootless Podman as a drop-in Docker CLI replacement that needs no privileges, the Sysbox runtime which runs Docker inside a container without --privileged, or wrapping the whole dev container inside an actual VM for the strongest isolation. Each carries tradeoffs in setup complexity versus isolation strength, and a dedicated follow-up post covers what worked and failed in practice. Developers hardening agent sandboxes around Docker can follow the upcoming hardening write-up on daily.dev."}}]} ```