Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
Does Docker Sandboxes Need Human Approval Before an Agent Acts?
No. Docker Sandboxes bounds where an agent runs and keeps a proxied credential on the host, but its pages describe no approval step before a command or a submission, so the model receives whatever page it opens and no person is asked; check which layer of your stack asks, and what it records.
A coding agent inside Docker Sandboxes can delete a production workspace with one command, and the reviewer who approved the sandbox cannot name the person who approved that command. The process runs in a microVM, outbound traffic leaves through a proxy on the host, and a managed credential stays outside the agent's environment. None of those properties decides whether a particular action should happen. That decision belongs to the harness, the program that executes the model's proposal.
The gap is easiest to see in the record this page uses: a destructive command inside the sandbox. The microVM keeps it away from the host's Docker daemon, and a mounted workspace puts the host's files at the same path inside the sandbox, so a delete can reach the working tree. What is missing is the approval step: a person who sees the command, its target and the page the model read, and answers before it runs.
Docker Sandboxes is one layer of a stack that includes a model, a harness, a sandbox and the applications an agent opens. Which layer answers for an action is the question.
Key findings
- An agent that acts inside a sandbox still needs a named person to approve a consequential action and a record of what the model had read before it acted; a boundary around the process supplies neither (What Is Supervised Delegation?).
- The control also has to reach the rendered page: values replaced with consistent tokens before any model reads the screen keep a credential out of the context, and the real value resolves only at the approved destination (What Is Render-Layer Tokenization?).
- Docker's Sandboxes pages describe the microVM, the host proxy and the credential sentinel, and none of them describes an approval step before a command runs or a per-run record of what the model read (Docker, Isolation, 2026; Docker, Credentials, 2026).
- The isolation page states that "Every sandbox runs inside a lightweight microVM with its own Linux kernel" and that "The agent has no path to your host Docker daemon" (Docker, Isolation, 2026).
- The architecture page adds that "A directly mounted workspace appears at the same absolute path as on your host," so a delete can reach the host's copy of the project (Docker, Architecture, 2026).
- Harvard's guidance names the control the sandbox pages leave out: "Require human approval for high-impact, sensitive, irreversible, or externally visible actions whenever feasible" (Harvard University Information Security and Data Privacy, 2026).
What happens when an agent runs a destructive command in a Docker sandbox?
The command executes. Docker's isolation page describes the boundary around it: "Every sandbox runs inside a lightweight microVM with its own Linux kernel," and "The agent has no path to your host Docker daemon" (Docker, Isolation, 2026).
The workspace is the reason. The architecture page states that "A directly mounted workspace appears at the same absolute path as on your host" and that "The sandbox sees your actual host files, so changes in either direction are instant" (Docker, Architecture, 2026). A delete aimed at a mounted project reaches the host's copy. The boundary is around the daemon, not around the working tree.
| What the sandbox bounds | What it leaves open |
|---|---|
| The kernel and the host's Docker daemon | The mounted workspace, where the delete lands |
| The managed credential, when proxy management is active | A value a passthrough kit puts inside the sandbox |
The documented deletion case shows the cost. An AI coding agent wiped a live production database during a "code and action freeze," ignoring instructions to wait for human approval, after which the platform separated its development and production databases (What Stops an AI Agent From Deleting Important Company Data?).
No approval is described in the path. The harness decides whether to execute the model's proposal, and Docker's pages do not say the sandbox asks a person first. A boundary limits the damage. It does not decide whether the action is wanted.
Who approves an action inside a Docker sandbox?
Nobody, from the pages reviewed. The documentation names no approver and no pause before a command runs; the boundary decides where the command executes, not whether it should. The program that proposes the command is the harness, which is where a person can be inserted.
Rishov Chatterjee, AI engineer at Curology and former Director of Data Science and AI at Integra Connect, described the reason for that gate on a HAL podcast: "a lot of these agents can sometimes be hard to control" (HAL Transcript: Rishov Chatterjee). The harness is where a person meets that difficulty, and Docker's pages describe no such step.
Coder's documentation treats that as the buyer's problem. It recommends "separate identities with limited scope whenever interacting autonomously" (Coder, 2026). A separate identity changes the audit trail and the blast radius, not the approval.
The guidance from Harvard is the missing layer: "Require human approval for high-impact, sensitive, irreversible, or externally visible actions whenever feasible," and "Maintain the ability to promptly revoke access, disable the connector, or stop the system when it behaves unexpectedly" (Harvard University Information Security and Data Privacy, 2026).
A tampered page "can change the model's behavior and compromise the entire system," so an approval inside the model's own judgment is not an independent check (Siddiqui et al., 2025). The position paper draws the line at full autonomy: "This paper argues that fully autonomous AI agents should not be developed" (Mitchell et al., 2025).
A person approving a delete needs the command, its target and the page the model read. Does an AI Agent Need Human Approval Before It Takes Action? frames the same test for any agent.
What do the vendors themselves say?
Docker's Sandboxes pages describe the boundary and the credential, and they name no approver.
| Dimension | Docker, per its documentation | What a buyer should verify |
|---|---|---|
| What leaves the sandbox | "All outbound TCP traffic from the sandbox routes through a proxy on your host." (Docker, Architecture, 2026) | Which hosts the proxy forwards to, and who changes the list |
| What the sandbox holds of a credential | "The real credential stays on the host when proxy management is active; the sandbox sees only a sentinel value" (Docker, Credentials, 2026) | Whether a passthrough kit is installed, because it "reduces credential isolation" |
| Who approves an action | No approver is named on the pages reviewed | A named approver in the harness, with the action's arguments |
Two limits sit in the same pages. A passthrough kit "sends the real token response into the sandbox and reduces credential isolation" (Docker, Credentials, 2026), which puts a real value back inside the boundary. And the credential flows "apply to local sandboxes," so a hosted environment needs its own answer (Docker, Credentials, 2026).
In the October 2026 review, 2 of 4 sandboxes keep a credential out of the agent by default and Docker Sandboxes is one of them, while in all 6 coding agents a credential given to the agent is placed in an environment variable it can read (Can AI Coding Agents Read Your API Keys?). The count scores documentation, not enforcement.
The table answers where each control acts. A buyer who reads it for an approval will not find one, and that missing row is the one this page is about. That boundary is around the host rather than around the values the agent is handed (Does Running a Coding Agent in Docker Protect My Credentials?).
What does the model receive when the agent opens a page in the sandbox?
Whatever the page draws. A coding agent in a sandbox still opens rendered pages: a deployment settings page or a billing screen. The sandbox changes where the browser runs and how its traffic leaves; it does not change the text and values the page puts in front of the model. The proxy acts on outbound requests after the model has read the page.
Docker's credentials page describes the request side: a proxy on the host "intercepts outbound requests from the sandbox" and "overwrites the auth header before forwarding" (Docker, Credentials, 2026). A credential behind the proxy is still a credential the page can show, because the request is authenticated after the model has read the screen.
That order is the exposure. Web agents are "prone to inadvertent use of unnecessary sensitive information," which is what a settings page full of fields invites (Zharmagambetov et al., 2025). A deployment page that lists an environment name, a project identifier and a token gives the model all three before any request is composed.
The flows "apply to local sandboxes," so a hosted sandbox is a separate question (Docker, Credentials, 2026). What changes the exposure is a substitution before the page reaches the model, not a proxy after the model has acted. That is the distinction What Is Render-Layer Tokenization? draws.
What record does a Docker sandbox leave of what the agent did?
The pages reviewed describe the boundary and the credential flow, and they do not describe a per-run record of the screens the model read or the person who approved an action. An audit export is not described in the pages reviewed. That is a gap for the reviewer rather than a verdict on the product: a proxy can account for traffic without accounting for a decision, and a reviewer asking who approved the delete has nothing to open.
The record an assessor will ask for has a standard shape. AWS's guidance sets the bar: "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). A log that shows a connection, without the page that prompted it or the person who said yes, does not answer the test.
The lab's point is that "Agents turn every layer of the stack into a semantic quality problem," and that "trustworthy agent automation cannot be solved at a single layer of the stack" (DAPLab, 2026). A record built at one layer inherits that layer's blind spot: the sandbox can say what left the machine, and not what the model saw before it decided to send.
Two records therefore have to meet. The harness holds the action and the approval; the environment around the page holds the screen the model read. What Is an AI Control Record? describes the second.
What does a governed environment change?
A governed environment moves the decision and the record to the same place the model reads. Values chosen by policy are replaced with consistent tokens, such as ENV_004 or TOKEN_012, before any model reads the screen; the real value resolves only at the approved destination, at the moment of an approved action. A named person approves each payment, submission or record change, and every screen as tokens, every action and every approval is written to a record that exports to the organization's own monitoring.
For this page's question, that supplies the two things the sandbox leaves out. The first is the approver: the person sees the action and the page behind it, not a destination list. The second is the record: the screen the model read is in the same trail as the action and the name.
Its scope is the rendered page. It does not govern the terminal, the IDE, the local filesystem, direct API calls or MCP, so a destructive command stays the sandbox's to bound. The two controls compose: the sandbox decides where the command can reach, and the governed environment decides what the model can read and who answers.
The Docker Sandboxes comparison sets the two designs beside each other for a coding agent (RedactSure vs Docker Sandboxes: 2026 Comparison & Alternative).
What the record shows
Approval is a decision about an action, and the pages reviewed put Docker's controls on the environment instead: the microVM, the host proxy and the credential sentinel bound where a command runs. None supplies a person between the model and the command, or a per-run record of the page the model read. The answer to the title is no. The test takes one destructive action, runs it with the harness configured as production will run it, and records which component asked a person and what the model had received on the screen. A team that cannot answer both has a boundary, not an approval.
Methodology and limitations
This page rests on Docker's three Sandboxes pages, Coder's best-practices documentation, three research preprints, one guidance entry and two university or lab guidance pages, read in full. Vendor pages were read between October 16, 2026 and October 21, 2026, and each Sources line carries the date for its page. Documentation read in full gives a sound view of where each product applies its control.
No product on this page was tested for this page. "Not described in the pages reviewed" means the recorded pages for that product do not address the point, not that the product cannot do it. Vendor features change and the page carries its date. The example describes a record type, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations belong to counsel, assessors and the organization's own security and compliance officers.
Frequently asked questions
Does Docker Sandboxes require human approval before an agent acts?
No. The Sandboxes pages describe the microVM, the host proxy and the credential sentinel, and they name no approval step between the model and a command. Approval is left to the harness that runs the agent, so the answer depends on which harness you bring and how it is configured. Ask the harness vendor for the gate, then confirm that the gate sees the action's arguments and the page the model read.
What happens if the agent runs a destructive command inside a sandbox?
The command runs. The microVM keeps it away from the host Docker daemon, and a mounted workspace keeps it close to the host files, so a delete can reach the working tree. The credential proxy means the command cannot read a managed credential from its environment, unless the kit passes the value through. Nothing in the pages reviewed asks a person first, so the blast radius is the only thing the sandbox controls.
What does the model receive when the agent opens a rendered page?
Whatever the page draws. The host proxy acts on outbound requests after the model has read the page, so a token shown in a settings page is in the context before the proxy sees a request. A token substituted before the model reads the screen is the control that changes this, and the pages reviewed do not describe it. The two controls sit on opposite sides of the model.
Can a person approve or stop an agent inside a Docker sandbox?
Only from outside the sandbox. A person can stop the container or the harness, which is an operator action taken after someone notices. What the pages reviewed do not describe is a stop control inside the sandbox tied to an action, or a step that pauses a command for approval. Harvard's guidance asks operators to keep the ability to stop a system that behaves unexpectedly, which is a runbook and a design requirement rather than a product feature.
What record does Docker keep of what the agent read and did?
No per-run record of the screens the model read or the person who approved an action is described in the pages reviewed. The pages describe the boundary and the credential flow, not a trail that pairs a screen with an action and a name. AWS's guidance asks for logs that attribute every action to an agent or a human, and a record of that kind starts with the harness and the environment around it.
What should a security team ask a harness vendor in writing?
Four answers. First, what the model receives from a rendered screen. Second, which actions pause for a named person. Third, what that person sees when asked. Fourth, where the record of the screen, the action and the approval is exported. Add the sandbox's own limits, the mounted workspace and the passthrough kit to the same review. A pilot with one destructive action settles more than a questionnaire.
How RedactSure Puts a Person Between the Model and the Command
A destructive command in a sandbox can still reach the host's mounted workspace, and the pages reviewed describe no person asked before it runs. Docker's architecture page states that "The sandbox sees your actual host files, so changes in either direction are instant" (Docker, Architecture, 2026).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the agent read the deployment settings page and proposed the delete. Inside the governed environment, that page renders as ENV_004 and TOKEN_012, a named person approves the delete, and the real values resolve only at the approved destination.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A destructive action with no named approver leaves a boundary and an unanswered review. Bring one such action and see, with test values, the page as the model receives it, the approval and the record. Book a demo