YOLO Mode, Safely: MicroVM Sandboxes for Any Agent — Rowan Christmas, Docker

AI Engineer · 11 min · 153 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

1. 00:12Hey everybody, I hope you had a good lunch.
2. 00:15I know it's one of the last talks of the entire conference.
3. 00:18I tried to make it somewhat engaging and amusing.
4. 00:22So, you know, audience participation is is encouraged.
5. 00:26We'll see how it goes.
6. 00:27So, I'm here with Docker.
7. 00:29Uh, I'm one of our product managers that works on our new sandbox product.
8. 00:33I don't know if you've seen it.
9. 00:34It's a new binary for Docker.
10. 00:36It's called SBX.
11. 00:37Uh, it's a microVM.
12. 00:39It's really cool.
13. 00:40You should come check it out.
14. 00:41But I'm going to tell you why uh you might want to use it in context of agents doing governance and being safe in general for your agentic platforming needs.
15. 00:54So right now, you know, all of you are doing way more AI than you ever thought you would 5 years ago.
16. 00:59At least I am.
17. 01:00And we generally think that we're being protected by our coding harnesses because if we try to do something bad, they will sometimes stop us.
18. 01:09And when we see stories, we think, "Oh my gosh, I would never make this mistake to have my AI drop my prod database.
19. 01:17You know, I've been doing coding for 30 years.
20. 01:19There's no way I would possibly do that."
21. 01:21So what I decided to find out was well what happens if I actually try to hack myself and how far can I get with you know our tools and what we've been told is a safe environment.
22. 01:35So I opened up my claude code on desktop on my Mac and I had it look for my browser history uh and it found it right away which I was very impressed about.
23. 01:45And I asked it uh what can I what can I do with this?
24. 01:49And so we started looking at my bank accounts which I was uh surprised about.
25. 01:55And it found them.
26. 01:56Uh which I was very unhappy about.
27. 01:58I made fake bank names.
28. 02:00This is not my real data, just so you know.
29. 02:02But it did find all of my real bank data on there.
30. 02:06Uh and it went even further.
31. 02:07It found that I've been ordering checks recently, that I've been using zel.
32. 02:11It told me the last four digits of the account I was using.
33. 02:14Um I was I was very impressed.
34. 02:18And here's kind of an idea of all the PII that it found.
35. 02:22Um, this is from again the clawed desktop app uh that we thought was safe.
36. 02:28Anyways, maybe maybe there's a better solution.
37. 02:31Who knows?
38. 02:32So, the next day I came in and I got from my security team uh a nice little notice that I they thought I'd been hacked.
39. 02:39And so I had to explain to them that no, no, no, I'm just putting together a talk for this conference and uh please please don't flag me as a as a a compromised computer.
40. 02:49And then they sent me the crowd strike report from this which I asked them to do.
41. 02:54And I was quite impressed with it.
42. 02:56Apparently this is a known way to get uh credentials from a machine.
43. 03:00Didn't realize that.
44. 03:02And I had scored very well on this.
45. 03:03I got a nine out of 10 which uh is better than I did in most of my classes.
46. 03:07So that was that was really good.
47. 03:11But fortunately this was just me internally.
48. 03:13It was not some sort of you know injection from a script or MCP server or anything that could easily happen.
49. 03:21So five five prompts is what it took.
50. 03:24Um I had to be a little clever.
51. 03:25I couldn't if I just if you just ask straight up like hey Claude go find my bank data.
52. 03:31It kind of it it will give you a warning.
53. 03:33But if you say, "I'm researching how to do security," it'll happily go and help you do that research on your account.
54. 03:41It is not uh it's not your friend.
55. 03:45So if if only there was a better way to do this using a sandbox microVM technology that Docker and others have released recently.
56. 03:56So rather than just saying please which you know if you look in some of these cloud prompts you'll see please don't do nefarious things right like that is the level of security we're at.
57. 04:05So now we've got microVMs if you're not aware of them compared to I know you're probably all aware of Docker been using it for years.
58. 04:13The new thing now that we and others are doing is with microVMs they run their own kernel.
59. 04:18They isolate your file system.
60. 04:20We have a system that will go and make sure that the sandbox never actually sees your secrets.
61. 04:26When you try to go and do a network request, it takes a placeholder, replaces it so that your sandbox and your agent can't do bad things.
62. 04:34We've got a full audit trail for it.
63. 04:36Uh so yeah, we want to be you want to be secure by design, not just, you know, hope and say please and see what's going to happen.
64. 04:47We're trying to do this balancing act, right?
65. 04:49If we don't actually if we can't actually do these things, the agent's not useful.
66. 04:53So that's why this whole sandbox idea is so exciting for us.
67. 04:58We encourage you to use it.
68. 05:00Um, and maybe, you know, don't let your bank data get into the hands of your agent.
69. 05:05That's not that's not what you want.
70. 05:08So this is what it looks like in practice when you're running a sandbox.
71. 05:12Uh on the uh left side is when I run claude and on the right side is when I do sbx run claude.
72. 05:21And you can see that there there's a lot of uh differences.
73. 05:24That's a joke.
74. 05:25Sorry, they're not.
75. 05:26It's just the bypass permissions are on, but it's nothing nothing else uh was hard to do.
76. 05:32Right.
77. 05:32Running that command on the right automatically creates a new VM.
78. 05:36It spins it up in that folder and it makes a new sandbox for you.
79. 05:40It runs your agent.
80. 05:42Now you're up and running.
81. 05:43It can't see anything.
82. 05:45So if we try to do our browser history attack on regular claude, it happily goes and finds your browser history.
83. 05:54But if I run it on the sandbox version, it does not even think there's a browser installed on your machine.
84. 06:02So pretty cool.
85. 06:04No difference.
86. 06:04I had to type uh seven more keystrokes to get here, but I think it's well worth the uh the price to pay.
87. 06:14Same thing is true for network egress and ingress.
88. 06:17So, right here, I'd uh I tried to get it to go and look up uh the pirate bay because I I knew that would be blocked and sure enough, blocked by
89. 06:25default.
90. 06:26The other thing you kind of see, it's hard, maybe it's hard to see, but like the uh Claude likes to really send back a lot of telemetry data to their data dog instance.
91. 06:35So if you're using Claude, uh you are sending anthropic a lot of your data, unless you're using sandboxes, in which case you're cleverly being blocked by that.
92. 06:45The other thing I'll say about sandboxes, they're so easy to use.
93. 06:49Every developer at Docker now writes all of their code in sandboxes.
94. 06:53So we are using this every day.
95. 06:54Hey, we're writing all of our code in it.
96. 06:56If we don't use it, we get uh we get yelled at.
97. 06:59So, it's worth our time to to go and do that little defaults on this.
98. 07:05All of this is configurable.
99. 07:06Um, and so now that we talked about like why this matters, right?
100. 07:10So, doing this at the harness level doesn't really work.
101. 07:13Agents find their way around it.
102. 07:15If it gets down to your host machine, it's too late.
103. 07:18So, you want to be at that microVM boundary.
104. 07:21We think it's the best way.
105. 07:23other people do too.
106. 07:26And it's easy to use.
107. 07:29If you're working in consulting, if you've got a, you know, chief security officer, if you do client work, whatever it might be, you're probably dealing this with this on a day-to-day basis.
108. 07:40So, not only do you want this to be useful, but also you want to do things and enable your agents to do different things, right?
109. 07:48So, one of the things we're really excited about is doing like agent level identity tracking and delegation chains.
110. 07:54So, when you can start saying, "Hey, how come this thing happened?"
111. 07:58And you can go back and say, "Oh, that's because an agent did it and a human actually authorized that agent to do it.
112. 08:04It didn't just happen by magic.
113. 08:05We didn't know.
114. 08:06We don't it's not like we don't know how what happened."
115. 08:08Now, we're going to start tracing that, tell you tell you about it, and let you write policy that actually goes and does degradation of uh what you can do
116. 08:19based on Cedar policies based on new new things happening.
117. 08:24And you might say to yourself, "Oh my gosh, this is so good.
118. 08:27I would like I would like to buy it now.
119. 08:30How do I how do I buy this from you guys?"
120. 08:32And so I have my marketing slide that my marketing team is really mad at me that I made this, but I think it's funny and cute for AI governance.
121. 08:40So definitely talk about that.
122. 08:43Okay.
123. 08:43What does AI governance look like?
124. 08:46You're doing this is what this is what it looks like in kind of a mockup.
125. 08:49So right now we've do we do network, you can set allow, deny, you can do file system uh points, and you can also decide what your MCP catalog looks like.
126. 09:00Also, if you're running our MCP server, our MCP servers themselves run on a sandbox.
127. 09:06So, they are also governed by all of these different controls.
128. 09:11In the future, we're going to be adding more stuff.
129. 09:13One of the things we've heard from a lot of people at this conference is that they want to do uh L7 networking controls.
130. 09:20They want to do uh like per GitHub repo file system level controls, right?
131. 09:27like you want your agent to be able to read and write to some repos and some areas of some repos but not others, right?
132. 09:34So, all of this is going to be coming down the line, but everything that I've showed you today is working.
133. 09:39Um, and you should come by our booth and see that it's easy to install.
134. 09:47We run on Mac, Windows, and Linux uh based on your uh package manager of choice.
135. 09:54And you can see at the end it's just sbx run.
136. 09:58It's not just cloud by the way.
137. 10:00The the sandboxes are a full VM.
138. 10:02So you can run a shell, you can run codeex, you can run whatever, you can run a python job, you can run a web server, anything you want to do, but we want to make it easy for you to get in and up and running.
139. 10:14So this is kind of our default.
140. 10:15So you can just get in, you can get that cloud code or codeex instance going.
141. 10:21It feels native.
142. 10:22It works just the same way as your one did today, but you've got all these protections in store.
143. 10:28Uh, additionally, you can mount other file systems.
144. 10:31So, what I do is when I'm working on a, you know, a piece of code with related repositories, I'll mount those uh, read only.
145. 10:39That way, my agent can see what I'm doing, it can see my other codebase, but I know it's not going to make random commits to other repos just to make my thing work, right?
146. 10:48I want the guarantee that it's actually doing what it says it's doing with the API that I've specified.
147. 10:55So that's it.
148. 10:58Pretty short.
149. 10:59We have a booth.
150. 11:00We have a few sunglasses left and some power banks to give away.
151. 11:04You should come by our booth and I'll walk over there afterwards and give you the demo and then you can look as good as uh Macho Man Randy Savage with those glasses.
152. 11:14So there you go.
153. 11:15Thank you.