Reproducing the devcontainer DX, but securely Docker's sbx sandboxes can now be connected to VS Code over SSH, letting developers compile and run code inside an isolated microVM with secrets protection and network policies instead of on the host machine, according to a Docker documentation-based walkthrough. The setup uses sbx kits — declarative YAML configurations — plus the `sbx setup ssh` command, which adds a `*.sbx` block to `~/.ssh/config`, and the `sbx env create` and `sbx env rm` commands to manage the environment. The example `vscode-ssh` kit (version 0.1.0, MIT licensed) builds on the `docker/sandbox-templates:shell` image, installs VS Code Remote-SSH server dependencies, and restricts network access to VS Code update and marketplace domains. I have always loved using devcontainer https://containers.dev/ , because it lets VS Code open a project in a preconfigured container with its tools, dependencies and extensions, so you can start coding right away in a reproducible environment without installing everything on your machine. devcontainer connects VS Code to the container, so you keep your usual editor while using the container's tools and dependencies for the terminal, autocompletion, tests and debugging: you develop in the same environment as the one where the code runs . Today, with sbx and its SSH access https://docs.docker.com/ai/sandboxes/integrations/ feature, you can absolutely connect VS Code to a running sbx sandbox over SSH. Your code is then compiled and executed inside this isolated environment, rather than on your host machine. You get a setup similar to what devcontainer offers, but with the security hardening tools of sbx such as the microVM, secrets protection and network policies. Let's see how to put this into practice with sbx kits https://docs.docker.com/reference/cli/sbx/kit/ , and make it all smooth and straightforward thanks to the sbx env create and sbx env rm commands. Docker sbx kits are declarative YAML configurations that define sandboxes and enrich them with network policies, environment variables, commands ... Prerequisites prerequisites First of all, you need VS Code installed. Then, you need to install the Remote-SSH extension in VS Code only once : code --install-extension ms-vscode-remote.remote-ssh Then, you need to add the .sbx block to ~/.ssh/config idempotent : sbx setup ssh Creating the vscode-ssh kit creating-the-vscode-ssh-kit vscode-ssh kit In a folder, create a tree like this one: . ├── demo │ └── README.md ├── kits │ └── vscode-ssh │ ├── config │ │ └── machine-settings.json │ ├── kit.dockerfile │ └── kit.yaml └── sbxenv.yaml - The demo folder will be the VS Code workspace this is where you can create the .vscode folder with the extensions.json and settings.json files - The kits folder will contain all the kits needed to build our secure working environment. - The sbxenv.yaml file will let us manage the environment of our sbx sandbox think of it as the compose file of sbx vscode-ssh vscode-ssh vscode-ssh The kit is made of the following 3 files: vscode-ssh/config/machine-settings.json : { "telemetry.telemetryLevel": "off", "update.mode": "none", "extensions.autoUpdate": false, "terminal.integrated.defaultProfile.linux": "bash" } vscode-ssh/kit.dockerfile : syntax=docker/dockerfile:1 vscode-ssh: the shell template FROM docker/sandbox-templates:shell USER root What the VS Code server expects on a Remote-SSH host RUN <