--- title: "📱 On Stream: Agent Sandboxes" url: https://daily.dev/posts/on-stream-agent-sandboxes-kzlrlm2r3 source_url: https://www.youtube.com/watch?v=vbe1nAxDJSI type: video:youtube source: "Bret Fisher" published: 2026-05-31T07:40:41.627Z updated: 2026-05-31T07:50:15.561Z tags: ["security", "docker", "ai-agents", "claude-code"] reading_time: 166 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # 📱 On Stream: Agent Sandboxes **[Bret Fisher](https://daily.dev/sources/bretfisher)** · 166 min read · 0 upvotes · 0 comments ## Summary A live stream walkthrough comparing different sandboxing approaches for AI coding agent harnesses (Claude Code, Codex, Cursor, Copilot). Covers four isolation tiers: built-in harness sandboxing (Claude Code's /sandbox using macOS Seatbelt or Linux Landlock/Bubblewrap), third-party host-native tools like nono.sh (from the Sigstore team), traditional Docker containers, and Docker Sandboxes (SBX CLI) which spins up per-project micro-VMs. Key motivations include enabling 'yolo mode' (dangerously-skip-permissions) safely, controlling which CLI tools and API keys agents can access, and avoiding agents accidentally touching infrastructure credentials. Trade-offs discussed: built-in sandboxing is easiest but least isolated and model-breakable; nono.sh adds kernel-level file system restrictions without containers; Docker containers offer strong isolation but complicate Docker-in-Docker scenarios; Docker Sandboxes provide the most complete isolation at the cost of heavyweight VM overhead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#docker](https://daily.dev/tags/docker), [#ai-agents](https://daily.dev/tags/ai-agents), [#claude-code](https://daily.dev/tags/claude-code) [View this post on daily.dev](https://daily.dev/posts/on-stream-agent-sandboxes-kzlrlm2r3)