Docker Sandboxes makes YOLO mode the default

Docker shipped Sandboxes, a standalone CLI that isolates each coding agent inside a microVM with a separate kernel, filesystem, network, and Docker daemon, per the product page for Sandboxes.

That's why Docker runs --dangerously-skip-permissions, known as YOLO mode, by default inside the box. Developers who've avoided full-autonomy agent modes because one bad command could wreck their host machine now get a boundary that survives the mistake.

No Docker Desktop install is required, since Sandboxes ships as its own CLI. It works out of the box with six agents: Claude Code, Gemini CLI, Copilot CLI, Codex, OpenCode, and Kiro.

API keys never reach the agent itself. They stay in the host keychain, and a host-side proxy injects the auth headers, so a compromised or careless agent inside the sandbox can't read raw credentials. That protection applies across all six supported agents.

Networking is deny-by-default across three profiles, so an agent can't reach the open internet unless a profile explicitly allows it.

Permission prompts were never the safeguard that mattered. Developer attention doesn't scale to an agent running unattended, and Docker's real move is shifting the trust boundary to something that does. Whether other agent CLIs move to VM-level isolation instead of leaning on prompts alone is the next thing worth watching.