2 different platforms, 2 separate sources of truths for policies, 2 different level of compatibility (apple containers don't support compose, MS uses a custom moby implementation, neither are particular mature), none has linux compatibilty?

Yes, but both would save on Docker licenses and it isn't as if anyone would pay for Docker tooling on Linux anyway.

So how does Docker capitalise on this new tool?

They keep trying to stay relevant in a world where containers have become commodity.

Sandboxes are free, distributed outside of Docker Desktop, no license fee required - money is made on enterprise governance and cloud offerings.

You can call containers a commodity, or an industry standard? Feels like that is more an emotional argument than anything else.

You actually do not need any licence (though a docker account is needed) to use docker sandboxes with the CLI. It's at least what the linked page says (ans my own experience ;)

Always assumed the SoMe sharing buttons was primarily motivated by the social sites to get their pixel on as many sites as possible to track behavior across sites

Company sells product for profit - they are liable for the product and all its subcomponents - there is nothing unfair about this - it doesn't matter if you found the components in a hole in the ground or on github - if you are selling a product based off it, you are liable.

For freelancers / oss companies - you can still sell services such as consulting or support - without selling your oss project - then its a service - not a product.

Uh, this looks very nice - reminds me of a TUI version of Canopy, if you are interested, We've (docker) been working on a separate agent sandbox runtime called SBX built around a MicroVM with a private docker daemon inside, maybe there's potential for a collaboration to add support for this runtime - feel free to ping me: per(dot)krogslund(at)docker .com

I sent you an email!

This article is from February - we have since shipped the microvm sandbox engine as a seperate binary: sbx - no docker desktop required, small 50mb binary.

https://docs.docker.com/ai/sandboxes/

Not sure how well their work maps to sbx, but there has been multiple releases with features and improvements since then

Interesting to see the adjective "small" used to describe a single binary in the same amount of space used by an entire embedded Linux-based operating system.

> sbx - no docker desktop required

I usually run OrbStack instead of Docker Desktop on my Mac (Docker Desktop is installed on my system, just not running) and when I tried running sbx, it ignored my OrbStack setup and auto-launched Docker Desktop's daemon instead.

If it's possible to bypass that and tell sbx to use OrbStack instead, I'd love to know how.

Is this a closed source product?

MicroVM based sandboxes for agents, with container support, in a small independent binary installable from brew/winget

Docker sandboxes uses a MicroVM as an additional isolation layer - its not just containers (as also mentioned in the nanoclaw post)

This still does not help with, you can call foo, but not bar. We have plenty of existing tooling for that too.

Outlining this as precision versus using 100s of thousands on chainguard, seems like 2 extremes pitted against eachother, when hardened images is largely free now: https://hub.docker.com/hardened-images/catalog

- Each agent runs in a dedicated microVM - agents can build and run Docker containers inside the MicroVM - no access to the host Docker daemon - network isolation with allow and deny lists - available for macOs and windows (linux support coming)

> no access to the host Docker daemon

I believe this is likely the only downside, but for good reasons!

I was not aware of this one but I am talking about running it on the cloud like making a direct competitor to modal