{"slug": "agent-sandbox-comparison-microsoft-execution-containers-vs-docker-agent-vs-and", "title": "Agent sandbox comparison: Microsoft Execution Containers vs Docker Agent vs Agent37, and the defaults that bite", "summary": "Docker Agent's `--sandbox` flag defaults to `false`, making Docker's microVM sandbox the only one of three agent containment layers users can apply themselves to Claude Code or OpenAI Codex as of October 2026, according to a comparison checked on 13 October 2026. Microsoft Execution Containers (MXC) 1.0.0, released 7 October 2026, denies network egress by default but is an SDK agent vendors must embed, used so far only by GitHub Copilot and Codex on Windows, both opt-in. Agent37, launched on Hacker News on 12 October, hosts the agent in a gVisor sandbox for $4.76 a month always on but leaves the public internet open.", "body_md": "# Agent sandbox comparison: Microsoft Execution Containers vs Docker Agent vs Agent37, and the defaults that bite\n\nTo contain a coding agent on your own machine in October 2026, use Docker's microVM sandbox: it is the only one of the three you can put around [Claude Code](https://stackness.dev/tools/claude-code) or [OpenAI Codex](https://stackness.dev/tools/codex-cli) yourself today. [Microsoft Execution Containers](https://stackness.dev/tools/microsoft-execution-containers) (MXC) 1.0.0, released on 7 October 2026, denies network egress by default, but it is an SDK the agent's vendor builds in, and only GitHub Copilot and Codex on Windows use it so far, both opt-in. [Docker Agent](https://stackness.dev/tools/docker-agent) runs its tools in a microVM with a default-deny proxy, but its `--sandbox` flag defaults to `false`. [Agent37](https://stackness.dev/tools/agent37), which launched on Hacker News on 12 October, moves the agent to a hosted gVisor sandbox for $4.76 a month always on, with the public internet left open.\n\n## What is an agent containment layer?\n\nAn agent containment layer limits what an agent's process can read, write and reach on the network, from outside the agent's control. Microsoft's [announcement](https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/) puts the case in one line: \"An agent cannot be its own security authority.\" The layer can sit in three places, and the three products sit in different ones.\n\n1. **Around the commands the agent spawns.** Claude Code's`/sandbox` , Codex's`workspace-write` mode and Copilot's`/sandbox enable` live here, and so does MXC, which vendors use to build this layer on Windows, Linux and macOS. Claude Code's[sandbox docs](https://code.claude.com/docs/en/sandboxing) say its file tools, hooks and local MCP servers still \"run with your full access\".\n2. **Around the whole agent process.**[Docker Sandboxes](https://stackness.dev/tools/docker-sandboxes) (the`sbx` CLI) boots a microVM per agent, and Docker Agent's`--sandbox` mode hands its run to it. Anthropic's own advice for the gaps in layer 1 is to \"run the Claude Code process itself in a container, virtual machine, or the sandbox runtime\".\n3. **On someone else's machine.** Agent37 is one of several hosted options; its founder[counted](https://news.ycombinator.com/item?id=50060907) \"probably 5+ companies doing something similar\" in his Y Combinator batch alone.\n\nThe framing that three containment products shipped in one week is half right. MXC 1.0.0 and GitHub's MXC-based [Copilot local sandboxing](https://github.blog/changelog/2026-10-07-local-sandboxing-for-github-copilot-now-generally-available/) did ship on 7 October. Docker Agent's sandbox mode and network allowlist were merged in [May](https://github.com/docker/docker-agent/pull/2888); what landed that week was a Hacker News front page and a [dev.to post](https://dev.to/slabb/docker-just-shipped-the-agent-wall-i-wanted-its-off-by-default-f18) on 9 October about the default, whose author says he did not run the tool.\n\n## The facts that decide, side by side\n\nThe deciding facts are where each layer sits, whether egress is denied without you doing anything, and whether you can install it yourself. All values are from each project's docs, release notes and pricing page, checked on 13 October 2026.\n\n|  | MXC 1.0.0 | Docker Agent `--sandbox` on Docker Sandboxes | Agent37 | \n|---|---|---|---|\n| What it is | SDK the agent vendor embeds | Agent harness plus microVM runtime | Hosted sandbox per agent | \n| Isolation by default | Process sandbox: AppContainer, Bubblewrap, Seatbelt; VM backends experimental | MicroVM with its own kernel and Docker Engine | gVisor; full VMs cost more | \n| Turned on by default | Egress and file access deny by default, once the agent uses MXC | No, `--sandbox` defaults to`false` | Yes, the agent never runs locally | \n| Network egress | Deny; allow rules are IP ranges and ports only | Default-deny proxy that allows model providers | Public internet open; host and private networks blocked | \n| Files | Empty allow lists | Working directory read-write, nothing else from the host | Sandbox's own persistent disk | \n| Policy | Versioned JSON or typed SDK request | YAML `runtime.sandbox` ,`docker agent sandbox allow <host>` ,`sbx policy` | API and dashboard | \n| Platforms | Windows 11 24H2 build 26100.9278 or later, Linux, macOS 15 | Apple silicon on macOS 14, Windows 11 with Hypervisor Platform, Ubuntu 24.04 with KVM | Any client | \n| Licence | MIT | Docker Agent Apache-2.0; `sbx` not open source | Proprietary; gateway open source | \n| Price | Free | Free locally; Docker cloud from $0.07 an hour | $4.76 a month for 2 vCPU, 4 GB, always on | \n| Latest | v1.0.0, 7 October | Docker Agent v1.150.0, 9 October; `sbx` v0.47.0, 5 October | Launch HN, 12 October | \n\nNo independent benchmark of startup time or overhead exists for any of the three.\n\n## MXC is a library the agent vendor builds in, not a box you put around an agent\n\nMicrosoft Execution Containers is an SDK for Rust, .NET and Node.js that an agent calls to run each command under a policy. The [README](https://github.com/microsoft/mxc) says it \"builds into your app\". You cannot wrap Claude Code in MXC yourself: Microsoft lists Anthropic among partners that \"will be releasing support\", and on native Windows Claude Code [still runs commands unsandboxed](https://code.claude.com/docs/en/sandboxing).\n\nThe defaults are the strictest of the three. When a policy omits the network block, egress \"resolves to `deny`\", and file allow lists start empty, per the [schema docs](https://github.com/microsoft/mxc/blob/main/docs/schema.md). The catch is that allow rules take IP ranges, not hostnames, so allowing `api.github.com` needs a proxy you run. A minimal policy from the repository's [examples](https://github.com/microsoft/mxc/blob/main/docs/examples.md):\n\n```\n{\n  \"version\": \"1.0.0\",\n  \"containment\": \"processcontainer\",\n  \"process\": { \"commandLine\": \"python -c \\\"...\\\"\", \"timeout\": 30000 },\n  \"network\": {\n    \"egress\": { \"default\": \"deny\",\n      \"allow\": [{ \"to\": [{ \"cidr\": \"140.82.114.6/32\" }], \"ports\": [{ \"protocol\": \"tcp\", \"port\": 443 }] }] },\n    \"ingress\": { \"default\": \"deny\", \"hostLoopback\": \"deny\" }\n  }\n}\n```\n\nWhere MXC reaches users today, it is opt-in: Copilot's local sandboxing \"is turned off by default\", and Codex's `prefer_mxc` setting is still marked under development in the [source](https://github.com/openai/codex/blob/main/codex-rs/features/src/lib.rs) on 13 October. One open bug matters for anyone trusting the helpers: [issue #1455](https://github.com/microsoft/mxc/issues/1455), reproduced on 1.0.0, shows a helper-built policy granting read access to the whole system drive, `.ssh` and `.aws` included, when PowerShell 7 is installed. On the 227-point [Hacker News thread](https://news.ycombinator.com/item?id=50016956), one user who tried it wrote \"it's not a 1.0 release\".\n\n## Docker Agent's sandbox is a microVM that stays off until you pass --sandbox\n\nDocker Agent is Docker's own agent harness, bundled with Docker Desktop. With `--sandbox`, it runs every tool, shell, file access and background job, inside a Docker Sandboxes microVM: only the working directory is mounted read-write, other host files are not visible, and traffic goes through a proxy that allows the model providers and blocks package registries until you add them. The [sandbox docs](https://docker.github.io/docker-agent/configuration/sandbox/) list the flag's default as `false`.\n\nDocker does not say why it is off. My guess: the sandbox needs `sbx` installed separately plus hardware virtualization, so a default-on flag would fail on many machines. Without the flag, Docker Agent runs tools on the host, and Docker calls its approval modes \"defense in depth against unwanted tool calls, not a security boundary\". To turn it on per agent:\n\n```\nruntime:\n  sandbox: true\n  network_allowlist:\n    - registry.npmjs.org\n```\n\nFor Claude Code or Codex users, the part to use is Docker Sandboxes on its own: `sbx run claude` boots the same microVM around Claude Code, Codex, Copilot, Cursor and seven other agents, without Docker Desktop. On first run it asks for a network preset, Open, Balanced or Locked Down, with Balanced highlighted, and Docker's [security docs](https://docs.docker.com/ai/sandboxes/security/) warn that Balanced's defaults \"include broad wildcards\" such as `*.googleapis.com`. The same docs list what stays outside: local stdio MCP servers run on the host, and edits to Git hooks or `package.json` scripts in the mounted folder are live on your machine.\n\n## Agent37 moves the agent off your machine, with the public internet left open\n\nAgent37 runs each agent in a hosted gVisor sandbox with its own disk, prebuilt for Claude Code, Codex, OpenCode, OpenClaw, Pi and others. The [pricing page](https://www.agent37.com/pricing) charges $0.80 per vCPU, $0.70 per GB of RAM and $0.09 per GB of disk per 730-hour month, billed by the minute while awake. The $0.37 headline assumes 57 hours of use a month; a 2 vCPU, 4 GB sandbox running all month is $4.76.\n\nNothing in the sandbox can read your home directory. Its egress allows \"the public internet and nothing else\", per the [site](https://www.agent37.com), which blocks the host and private networks but lets an agent send what it holds anywhere. On the [Launch HN](https://news.ycombinator.com/item?id=50059096), a commenter called gVisor \"less secure than VMs\" while the price comparison is against VMs; the founder replied \"That's fair\". Another put it plainly: the \"sandbox protects the host. it does not protect your tokens.\" Agent37's price table of 31 providers is its own marketing, and gVisor sandboxes cannot run Docker inside.\n\n## Codex's background daemon shows what no command sandbox covers\n\nA command sandbox only wraps what the agent spawns, not the agent itself. Codex CLI 0.157.0, released on 25 September 2026, starts a persistent `codex app-server` daemon by default. According to [issue #48195](https://github.com/openai/codex/issues/48195), it survives closing every Codex window, copies a 374 MB package into `~/.codex`, checks for updates hourly and keeps the environment, proxy settings included, of whichever session started it.\n\nCodex's sandbox applies to \"spawned commands\", so the daemon runs with whatever your user account can read and reach. On 13 October the issue had 174 reactions and no OpenAI staff reply, and the setting was still on by default; the opt-out is `codex features disable daemon_auto_start`. Of the three layers, only a box around the whole process, such as Docker Sandboxes, would contain it.\n\n## What switching between them costs\n\nSwitching cost follows the layer. Leaving MXC is not your choice to make, because the agent vendor owns that integration, and its JSON policy only works with MXC. Docker Agent's sandbox is a few YAML keys, but leaving it means leaving Docker Agent as a harness; with `sbx` alone, what you carry is the `sbx policy` rules. Agent37 moves work off your machine, with its LLM gateway, connectors and cron API, and its [gateway](https://github.com/agent37-platform/gateway) is the only open-source part.\n\nOn Stackness, as of 13 October 2026, 8 real profiles list Claude Code, 7 list [Docker](https://stackness.dev/tools/docker), 7 list [Cursor](https://stackness.dev/tools/cursor) and 2 list Codex, after removing bot accounts ([data sources](https://stackness.dev/about/data-sources)). The numbers are small and say nothing about sandboxes, but they put Docker, one of the [DevOps and infrastructure tools developers list](https://stackness.dev/categories/devops-infrastructure), in as many stacks as the [AI coding tools](https://stackness.dev/categories/ai-tools) it would contain. For several agents at once, the [fleet consoles post](https://stackness.dev/blog/manage-multiple-coding-agents-from-one-workspace-orca-offrun-pi-pod-and-four-other-options-compared) compares where each one isolates them.\n\n## Pick MXC if, pick Docker if, pick Agent37 if\n\n**Pick MXC if:**\n\n- You build an agent and need one containment API across Windows, Linux and macOS.\n- You use [GitHub Copilot](https://stackness.dev/tools/github-copilot) and can run`/sandbox enable` today.\n- You run Codex on Windows 11 24H2 or later and can opt in with `prefer_mxc = true` .\n- You can run a proxy for hostname rules, and you skip the helper policies until issue #1455 is fixed.\n\n**Pick Docker Sandboxes or Docker Agent `--sandbox` if:**\n\n- You want a VM boundary around Claude Code, Codex or Cursor on your own laptop now.\n- You need Docker to work inside the box.\n- Your machine is Apple silicon, Windows 11 with Hypervisor Platform or Ubuntu 24.04 with KVM.\n- You choose Locked Down or review Balanced's wildcards, and turn `--sandbox` on in every agent file.\n\n**Pick Agent37 if:**\n\n- The agent should run when your laptop is closed, on a schedule or for other people.\n- Your laptop is the thing to protect, and the agent's credentials can live on a hosted box.\n- You can accept open internet egress and a gVisor boundary rather than a VM.\n- Cost per idle agent matters more than isolation strength.\n\n## Which of these do you use?\n\nNobody on Stackness runs Microsoft Execution Containers yet. Tick what you use and be the first.\n\n[Play Lonny Eagle Amateur Skater 4A pixel art skateboarding game. Signing up opens it straight away.Sign up to play](https://stackness.dev/games/lonny-eagle)", "url": "https://wpnews.pro/news/agent-sandbox-comparison-microsoft-execution-containers-vs-docker-agent-vs-and", "canonical_source": "https://stackness.dev/blog/agent-sandbox-comparison-microsoft-execution-containers-vs-docker-agent-vs-agent37-and-the-defaults", "published_at": "2026-10-13 09:44:39+00:00", "updated_at": "2026-10-15 05:15:48.816139+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Microsoft Execution Containers", "Docker Agent", "Agent37", "Docker Sandboxes", "GitHub Copilot", "OpenAI Codex", "Claude Code", "Anthropic"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/agent-sandbox-comparison-microsoft-execution-containers-vs-docker-agent-vs-and", "markdown": "https://wpnews.pro/news/agent-sandbox-comparison-microsoft-execution-containers-vs-docker-agent-vs-and.md", "text": "https://wpnews.pro/news/agent-sandbox-comparison-microsoft-execution-containers-vs-docker-agent-vs-and.txt", "jsonld": "https://wpnews.pro/news/agent-sandbox-comparison-microsoft-execution-containers-vs-docker-agent-vs-and.jsonld"}}