Docker won the container wars. But for AI coding agents — tools that write, run, and debug code autonomously — Docker is not always the right answer.
Agents are different from microservices. They run short-lived commands, not long-lived servers. They need isolation from your SSH keys, not port mapping. And they need to start fast — a 3-second Docker spin-up feels glacial when the agent launches 20 sandboxes per task.
Three alternatives have emerged: Podman, Bubblewrap (bwrap), and Firejail. Each solves a different problem.
The Problem #
AI coding agents run arbitrary code at machine speed. That code can be buggy, malicious, or prompt-injected.
"Agent decided to test if harmful command block worked by issuing a rm -rf /"— Reddit, r/LocalLLaMA
The post got 355 upvotes. The user had implemented a bubblewrap sandbox. It worked.
Podman: Docker Without the Daemon #
Same OCI standards. Same Docker-compatible CLI. Rootless by default, daemonless by design.
Why it works for agents:
- Rootless containers. No root-owned daemon socket.
- Quadlets and systemd integration. Run an agent as a systemd user service.
podman play kube
— test Kubernetes YAML locally.- Pods. Group agent tools into one pod.
Where it falls short:
-
~100-500ms startup. Noticeable for short-lived per-task sandboxes.
-
GPU passthrough requires CDI + SELinux workarounds.
-
macOS/Windows need Podman Machine (a Linux VM). Best for: Production agent services. Multi-tenant CI. Kubernetes-compatible isolation.
Bubblewrap (bwrap): The 50ms Sandbox #
~8k lines of C. Used by Flatpak and Codex CLI. Starts in under 50ms.
Why it works for agents:
- Sub-second startup. Create and destroy sandboxes per-command.
- No daemon, no root. Pure user namespaces.
- Minimal attack surface. Full TOCTTOU protection.
- Drops all capabilities. Zero Linux capabilities for the sandbox.
- Explicit filesystem control. Every path is deliberate.
"bwrap is much more honest: it's just a syscall wrapper, zero required privilege."— Hacker News
Projects using bwrap for agents:
— Runs Claude, Gemini, Goose in a bwrap sandbox.bubblewrap-aisandbox-bwrap-nix— Allows to run Opencode or other AI harnesses with nix, so it can install missing softwares as normal user without polluting the host system.Codex CLI— OpenAI uses bwrap for code execution isolation.** Claude Code**— Anthropic reported** 84% reduction in permission prompts**with bwrap sandboxing.
Where it falls short:
-
Linux-only. No macOS or Windows.
-
No image management. Manual bind-mounts.
-
No built-in resource limits. Best for: Per-command agent sandboxes. Local development. CI pipelines.
Firejail: Sandboxing for the Rest of Us #
SUID program with ~1000 pre-built profiles for Firefox, Chrome, Telegram, GIMP, and more.
Why it works for agents:
- Zero configuration.
firejail agent.sh
works out of the box. - Pre-built profiles. Two words:
firejail firefox
. - X11/Wayland isolation via built-in Xephyr support.
- Landlock support (experimental). Filesystem access without capabilities.
- Seccomp-log. Debug syscalls without blocking them.
"Firejail knows about Pulseaudio; bubblewrap does not."— bubblewrap README
Firejail is opinionated about desktop integration. For AI agents, minimal is usually better.
Where it falls short:
- SUID binary. Larger attack surface than bwrap.
- Blacklist-based profiles (mostly). Migrating to whitelists, but slowly.
- Built for desktop apps, not agent per-command patterns.
Best for: Browser-based agents. Desktop AI tools. "Just make it safe" without reading docs.
Decision Matrix #
| Criterion | Podman | bwrap | Firejail |
|---|---|---|---|
| Startup time | ~100-500ms | <50ms | <50ms |
| Isolation strength | High (ns + cgroups) | Medium (namespaces) | Medium-High (ns + seccomp + Landlock) |
| Rootless | Default | Yes | Yes (user ns) |
| Attack surface | Large (150k+ LOC Go) | Minimal (8k LOC C) | Medium (50k+ LOC C, SUID) |
| Pre-built profiles | No | No | Yes (~1000) |
| Image management | Yes (OCI) | No | No | | Portability | macOS, Windows (VM) | Linux only | Linux only | | GPU support | Yes (CDI) | Manual (/dev/dri) | Manual | | Best use case | Production agent services | Per-command sandboxes | Desktop agent isolation |
The Bottom Line #
For production agent infrastructure — multi-tenant, GPU-backed, CI-integrated — use Podman. Rootless, daemonless, systemd-native.
For local agent development — Claude Code, Codex CLI, custom scripts — use bwrap. Milliseconds startup, no setup, minimal surface. This is why Codex and Claude Code ship with built-in bwrap sandboxes.
For desktop agents — browser automation, GUI tools, "make Firefox safe" — use Firejail. The 1000 pre-built profiles make it the most practical choice.
And if you need stronger isolation than any of these? MicroVMs (Firecracker, gVisor, Kata). But that is a different post.
Links
Podman— containers/podman on GitHubBubblewrap— containers/bubblewrapFirejail— netblue30/firejailbubblewrap-ai— bwrap sandbox for agentsClaude Code sandboxingDocker sandboxes vs alternativesSandboxing AI agents on LinuxAI agent sandbox comparison 2026Coding agent sandboxes listReddit: "got my first rm -rf /"Reddit: Docker Alternative — PodmanReddit: Security by sandboxing — Firejail vs bwrap