Docker Cloud Sandboxes Run Coding Agents for 24 Hours

Docker introduced Cloud Sandboxes on September 26, 2026. The sandbox a coding agent used to occupy on a developer laptop can now sit on Docker infrastructure instead, which means the run survives a closed lid. The isolation story is unchanged: one microVM per agent, each with its own kernel and its own Docker daemon. The location moved, not the abstraction.

Handing a run over mid-task

A project in progress crosses over with sbx move my-project --to cloud, and a fresh cloud run starts with sbx --cloud run codex. Nothing is live-migrated: Docker captures the sandbox filesystem and rebuilds it on the far side. That is usually enough for an agent that edits files and runs tests, but a half-finished build restarts from scratch, and a cloud sandbox cannot touch local paths or local hardware at all.

The hourly math

The standard size — two vCPUs, 4 GB of RAM — is listed at $0.14 per hour, with the full range of sizes between $0.07 and $1.12 per hour. Billing is calculated to the second, paused sandboxes are not charged, and running sandboxes locally remains free. Entry requires sbx 0.45.1 or newer and a usage-based plan on a Personal or Pro account. A cloud sandbox defaults to one hour and can be configured up to 24 hours; when the clock runs out, resumable sandboxes pause and the rest are deleted.

The workload Docker is aiming at

Docker frames the shift this way: when agents worked in short bursts, the open question was whether the model could hold a task together, and now that they work in hours, the question is where those hours happen. Its own illustration is a dozen agents at once, five, ten or 21 hours each, with nobody watching them. Florin Lungu of Deutsche Bank is quoted saying that safe autonomous coding in microVM environments adds flexibility to his organization's workflows. Alongside the launch, the Sandbox Kit specification moved to Kits v3, where a kit is no longer a separate artifact but a standard OCI image you can build and pull like any other.

A sandbox is not a permission model

Agent access to MCP servers is routed through a gateway with network policies that restrict reachable endpoints, and credentials are injected by proxy so the agent never sees the raw values. Docker states plainly that this does not replace verifying the rights granted to connected services. Security researchers have pressed the same point: the box contains the agent, not the external systems it is legitimately allowed to call from inside it.

Still unanswered

Neither report we read gives a general-availability date beyond the announcement itself, a per-account cap on concurrent cloud sandboxes, or prices in any currency other than US dollars. We also found nothing in these sources about data center locations or how source code is retained inside a cloud sandbox. Teams under strict code-handling rules should settle that before the first --cloud run.