Agent sandbox comparison: Microsoft Execution Containers vs Docker Agent vs Agent37, and the defaults that bite

Docker Agent's `--sandbox` flag defaults to `false`, making Docker's microVM sandbox the only one of three agent containment layers users can apply themselves to Claude Code or OpenAI Codex as of October 2026, according to a comparison checked on 13 October 2026. Microsoft Execution Containers (MXC) 1.0.0, released 7 October 2026, denies network egress by default but is an SDK agent vendors must embed, used so far only by GitHub Copilot and Codex on Windows, both opt-in. Agent37, launched on Hacker News on 12 October, hosts the agent in a gVisor sandbox for $4.76 a month always on but leaves the public internet open.

Agent sandbox comparison: Microsoft Execution Containers vs Docker Agent vs Agent37, and the defaults that bite To contain a coding agent on your own machine in October 2026, use Docker's microVM sandbox: it is the only one of the three you can put around Claude Code https://stackness.dev/tools/claude-code or OpenAI Codex https://stackness.dev/tools/codex-cli yourself today. Microsoft Execution Containers https://stackness.dev/tools/microsoft-execution-containers MXC 1.0.0, released on 7 October 2026, denies network egress by default, but it is an SDK the agent's vendor builds in, and only GitHub Copilot and Codex on Windows use it so far, both opt-in. Docker Agent https://stackness.dev/tools/docker-agent runs its tools in a microVM with a default-deny proxy, but its --sandbox flag defaults to false . Agent37 https://stackness.dev/tools/agent37 , which launched on Hacker News on 12 October, moves the agent to a hosted gVisor sandbox for $4.76 a month always on, with the public internet left open. What is an agent containment layer? An agent containment layer limits what an agent's process can read, write and reach on the network, from outside the agent's control. Microsoft's announcement https://blogs.windows.com/windowsdeveloper/2026/10/07/microsoft-execution-containers-policy-driven-containment-for-ai-agents/ puts the case in one line: "An agent cannot be its own security authority." The layer can sit in three places, and the three products sit in different ones. 1. Around the commands the agent spawns. Claude Code's /sandbox , Codex's workspace-write mode and Copilot's /sandbox enable live here, and so does MXC, which vendors use to build this layer on Windows, Linux and macOS. Claude Code's sandbox docs https://code.claude.com/docs/en/sandboxing say its file tools, hooks and local MCP servers still "run with your full access". 2. Around the whole agent process. Docker Sandboxes https://stackness.dev/tools/docker-sandboxes the sbx CLI boots a microVM per agent, and Docker Agent's --sandbox mode hands its run to it. Anthropic's own advice for the gaps in layer 1 is to "run the Claude Code process itself in a container, virtual machine, or the sandbox runtime". 3. On someone else's machine. Agent37 is one of several hosted options; its founder counted https://news.ycombinator.com/item?id=50060907 "probably 5+ companies doing something similar" in his Y Combinator batch alone. The framing that three containment products shipped in one week is half right. MXC 1.0.0 and GitHub's MXC-based Copilot local sandboxing https://github.blog/changelog/2026-10-07-local-sandboxing-for-github-copilot-now-generally-available/ did ship on 7 October. Docker Agent's sandbox mode and network allowlist were merged in May https://github.com/docker/docker-agent/pull/2888 ; what landed that week was a Hacker News front page and a dev.to post https://dev.to/slabb/docker-just-shipped-the-agent-wall-i-wanted-its-off-by-default-f18 on 9 October about the default, whose author says he did not run the tool. The facts that decide, side by side The deciding facts are where each layer sits, whether egress is denied without you doing anything, and whether you can install it yourself. All values are from each project's docs, release notes and pricing page, checked on 13 October 2026. | | MXC 1.0.0 | Docker Agent --sandbox on Docker Sandboxes | Agent37 | |---|---|---|---| | What it is | SDK the agent vendor embeds | Agent harness plus microVM runtime | Hosted sandbox per agent | | Isolation by default | Process sandbox: AppContainer, Bubblewrap, Seatbelt; VM backends experimental | MicroVM with its own kernel and Docker Engine | gVisor; full VMs cost more | | Turned on by default | Egress and file access deny by default, once the agent uses MXC | No, --sandbox defaults to false | Yes, the agent never runs locally | | Network egress | Deny; allow rules are IP ranges and ports only | Default-deny proxy that allows model providers | Public internet open; host and private networks blocked | | Files | Empty allow lists | Working directory read-write, nothing else from the host | Sandbox's own persistent disk | | Policy | Versioned JSON or typed SDK request | YAML runtime.sandbox , docker agent sandbox allow <host , sbx policy | API and dashboard | | Platforms | Windows 11 24H2 build 26100.9278 or later, Linux, macOS 15 | Apple silicon on macOS 14, Windows 11 with Hypervisor Platform, Ubuntu 24.04 with KVM | Any client | | Licence | MIT | Docker Agent Apache-2.0; sbx not open source | Proprietary; gateway open source | | Price | Free | Free locally; Docker cloud from $0.07 an hour | $4.76 a month for 2 vCPU, 4 GB, always on | | Latest | v1.0.0, 7 October | Docker Agent v1.150.0, 9 October; sbx v0.47.0, 5 October | Launch HN, 12 October | No independent benchmark of startup time or overhead exists for any of the three. MXC is a library the agent vendor builds in, not a box you put around an agent Microsoft Execution Containers is an SDK for Rust, .NET and Node.js that an agent calls to run each command under a policy. The README https://github.com/microsoft/mxc says it "builds into your app". You cannot wrap Claude Code in MXC yourself: Microsoft lists Anthropic among partners that "will be releasing support", and on native Windows Claude Code still runs commands unsandboxed https://code.claude.com/docs/en/sandboxing . The defaults are the strictest of the three. When a policy omits the network block, egress "resolves to deny ", and file allow lists start empty, per the schema docs https://github.com/microsoft/mxc/blob/main/docs/schema.md . The catch is that allow rules take IP ranges, not hostnames, so allowing api.github.com needs a proxy you run. A minimal policy from the repository's examples https://github.com/microsoft/mxc/blob/main/docs/examples.md : { "version": "1.0.0", "containment": "processcontainer", "process": { "commandLine": "python -c \"...\"", "timeout": 30000 }, "network": { "egress": { "default": "deny", "allow": { "to": { "cidr": "140.82.114.6/32" } , "ports": { "protocol": "tcp", "port": 443 } } }, "ingress": { "default": "deny", "hostLoopback": "deny" } } } Where MXC reaches users today, it is opt-in: Copilot's local sandboxing "is turned off by default", and Codex's prefer mxc setting is still marked under development in the source https://github.com/openai/codex/blob/main/codex-rs/features/src/lib.rs on 13 October. One open bug matters for anyone trusting the helpers: issue 1455 https://github.com/microsoft/mxc/issues/1455 , reproduced on 1.0.0, shows a helper-built policy granting read access to the whole system drive, .ssh and .aws included, when PowerShell 7 is installed. On the 227-point Hacker News thread https://news.ycombinator.com/item?id=50016956 , one user who tried it wrote "it's not a 1.0 release". Docker Agent's sandbox is a microVM that stays off until you pass --sandbox Docker Agent is Docker's own agent harness, bundled with Docker Desktop. With --sandbox , it runs every tool, shell, file access and background job, inside a Docker Sandboxes microVM: only the working directory is mounted read-write, other host files are not visible, and traffic goes through a proxy that allows the model providers and blocks package registries until you add them. The sandbox docs https://docker.github.io/docker-agent/configuration/sandbox/ list the flag's default as false . Docker does not say why it is off. My guess: the sandbox needs sbx installed separately plus hardware virtualization, so a default-on flag would fail on many machines. Without the flag, Docker Agent runs tools on the host, and Docker calls its approval modes "defense in depth against unwanted tool calls, not a security boundary". To turn it on per agent: runtime: sandbox: true network allowlist: - registry.npmjs.org For Claude Code or Codex users, the part to use is Docker Sandboxes on its own: sbx run claude boots the same microVM around Claude Code, Codex, Copilot, Cursor and seven other agents, without Docker Desktop. On first run it asks for a network preset, Open, Balanced or Locked Down, with Balanced highlighted, and Docker's security docs https://docs.docker.com/ai/sandboxes/security/ warn that Balanced's defaults "include broad wildcards" such as .googleapis.com . The same docs list what stays outside: local stdio MCP servers run on the host, and edits to Git hooks or package.json scripts in the mounted folder are live on your machine. Agent37 moves the agent off your machine, with the public internet left open Agent37 runs each agent in a hosted gVisor sandbox with its own disk, prebuilt for Claude Code, Codex, OpenCode, OpenClaw, Pi and others. The pricing page https://www.agent37.com/pricing charges $0.80 per vCPU, $0.70 per GB of RAM and $0.09 per GB of disk per 730-hour month, billed by the minute while awake. The $0.37 headline assumes 57 hours of use a month; a 2 vCPU, 4 GB sandbox running all month is $4.76. Nothing in the sandbox can read your home directory. Its egress allows "the public internet and nothing else", per the site https://www.agent37.com , which blocks the host and private networks but lets an agent send what it holds anywhere. On the Launch HN https://news.ycombinator.com/item?id=50059096 , a commenter called gVisor "less secure than VMs" while the price comparison is against VMs; the founder replied "That's fair". Another put it plainly: the "sandbox protects the host. it does not protect your tokens." Agent37's price table of 31 providers is its own marketing, and gVisor sandboxes cannot run Docker inside. Codex's background daemon shows what no command sandbox covers A command sandbox only wraps what the agent spawns, not the agent itself. Codex CLI 0.157.0, released on 25 September 2026, starts a persistent codex app-server daemon by default. According to issue 48195 https://github.com/openai/codex/issues/48195 , it survives closing every Codex window, copies a 374 MB package into ~/.codex , checks for updates hourly and keeps the environment, proxy settings included, of whichever session started it. Codex's sandbox applies to "spawned commands", so the daemon runs with whatever your user account can read and reach. On 13 October the issue had 174 reactions and no OpenAI staff reply, and the setting was still on by default; the opt-out is codex features disable daemon auto start . Of the three layers, only a box around the whole process, such as Docker Sandboxes, would contain it. What switching between them costs Switching cost follows the layer. Leaving MXC is not your choice to make, because the agent vendor owns that integration, and its JSON policy only works with MXC. Docker Agent's sandbox is a few YAML keys, but leaving it means leaving Docker Agent as a harness; with sbx alone, what you carry is the sbx policy rules. Agent37 moves work off your machine, with its LLM gateway, connectors and cron API, and its gateway https://github.com/agent37-platform/gateway is the only open-source part. On Stackness, as of 13 October 2026, 8 real profiles list Claude Code, 7 list Docker https://stackness.dev/tools/docker , 7 list Cursor https://stackness.dev/tools/cursor and 2 list Codex, after removing bot accounts data sources https://stackness.dev/about/data-sources . The numbers are small and say nothing about sandboxes, but they put Docker, one of the DevOps and infrastructure tools developers list https://stackness.dev/categories/devops-infrastructure , in as many stacks as the AI coding tools https://stackness.dev/categories/ai-tools it would contain. For several agents at once, the fleet consoles post https://stackness.dev/blog/manage-multiple-coding-agents-from-one-workspace-orca-offrun-pi-pod-and-four-other-options-compared compares where each one isolates them. Pick MXC if, pick Docker if, pick Agent37 if Pick MXC if: - You build an agent and need one containment API across Windows, Linux and macOS. - You use GitHub Copilot https://stackness.dev/tools/github-copilot and can run /sandbox enable today. - You run Codex on Windows 11 24H2 or later and can opt in with prefer mxc = true . - You can run a proxy for hostname rules, and you skip the helper policies until issue 1455 is fixed. Pick Docker Sandboxes or Docker Agent --sandbox if: - You want a VM boundary around Claude Code, Codex or Cursor on your own laptop now. - You need Docker to work inside the box. - Your machine is Apple silicon, Windows 11 with Hypervisor Platform or Ubuntu 24.04 with KVM. - You choose Locked Down or review Balanced's wildcards, and turn --sandbox on in every agent file. Pick Agent37 if: - The agent should run when your laptop is closed, on a schedule or for other people. - Your laptop is the thing to protect, and the agent's credentials can live on a hosted box. - You can accept open internet egress and a gVisor boundary rather than a VM. - Cost per idle agent matters more than isolation strength. Which of these do you use? Nobody on Stackness runs Microsoft Execution Containers yet. Tick what you use and be the first. Play Lonny Eagle Amateur Skater 4A pixel art skateboarding game. Signing up opens it straight away.Sign up to play https://stackness.dev/games/lonny-eagle