GitHub Agentic Workflows (gh-aw) added Docker Sandboxes as a supported agent runtime in July 2026, letting AI coding agents run inside an isolated microVM with its own private Docker daemon while operating in GitHub Actions CI. The isolation lets an agent have broad shell and sudo access inside the sandbox while the outer workflow keeps a narrow network and file-patch surface. A walkthrough demo shows a Copilot agent running a Java 21 Testcontainers suite against PostgreSQL inside the sandbox, finding a seeded case-sensitivity bug, fixing it, and opening a draft pull request restricted to files under src/**. Setup steps cover installing gh-aw, configuring Docker credentials, compiling the Markdown workflow into a .lock.yml, and running it on a GitHub-hosted ubuntu-24.04 runner, plus trying sbx locally and pairing it with Docker AI Governance for org-wide policy and audit control.
Table of contents
What are GitHub Agentic Workflows?Configuring sbx in GitHub ActionsThe isolation boundary is a micro VMGiving the agent a defect worth findingRunning the workflow yourselfTry sbx on your laptopQuestions this post answers
How do I run an AI coding agent inside an isolated sandbox in GitHub Actions?
GitHub Agentic Workflows (gh-aw) added Docker Sandboxes (docker-sbx) as a supported agent runtime in version 0.82.9. You configure sandbox.agent.runtime as docker-sbx in the workflow's YAML frontmatter, compile the Markdown workflow with gh aw compile, and the agent runs inside a microVM with its own kernel and private Docker daemon on a standard ubuntu-24.04 GitHub Actions runner. daily.dev surfaces practical setups like this for teams adopting sandboxed CI agents.
Can an AI agent running in a Docker Sandbox access the host's Docker daemon?
No, each Docker Sandbox runs its own dedicated private Docker daemon with its own kernel, filesystem, and network stack, so the agent gets full root privileges inside the microVM without ever touching the host's Docker daemon. The only bridge between the sandbox and the host is the explicitly shared repository workspace, keeping the blast radius of agent mistakes contained. Teams weighing agent isolation trade-offs track architecture details like this on daily.dev.
How does Testcontainers work when running tests inside a Docker Sandbox in CI?
Testcontainers uses the sandbox's private Docker daemon socket, passed through with -v /var/run/docker.sock:/var/run/docker.sock, to launch dependencies like PostgreSQL exactly as it would on a local machine. In one demo run, this setup used Docker client and server version 29.7.1 and completed a full workflow with test failure detection, a code fix, and a passing suite in 11 minutes 16 seconds. Developers wiring Testcontainers into CI sandboxes can follow setups like this via daily.dev.