WEBVTT

NOTE Sentence-level transcript of https://www.youtube.com/watch?v=ZUZVNKFSmTM

NOTE One cue per sentence. Cue ids are the line anchors on /transcripts/ZUZVNKFSmTM.html. A cue ends where the next begins, or 2 s after its last word.

s1
00:00:01.309 --> 00:00:03.309
[music]

s2
00:00:13.040 --> 00:00:15.840
I guess I'm ready to start.

s3
00:00:15.840 --> 00:00:18.520
Uh can everyone can I I actually I can hear myself.

s4
00:00:18.520 --> 00:00:20.760
Yeah, so you guys can hear me.

s5
00:00:20.760 --> 00:00:22.280
Uh my name's Jim.

s6
00:00:22.280 --> 00:00:25.560
Uh I'm a engineer at Docker.

s7
00:00:25.560 --> 00:00:33.560
Normally when I introduce myself in the slides these days, or at least what I used to do, was I would say, "Hey, I'm Jim.

s8
00:00:33.560 --> 00:00:36.360
I uh like spaces, not tabs.

s9
00:00:36.360 --> 00:00:38.680
I use Neovim, not Emacs."

s10
00:00:38.680 --> 00:00:42.640
But, that's uh all irrelevant now.

s11
00:00:42.640 --> 00:00:49.840
So, uh I will say that I made this slide with uh I made this presentation with Claude Code.

s12
00:00:49.840 --> 00:00:51.080
I used the Codex model.

s13
00:00:51.080 --> 00:00:57.400
The MCPs that I that helped me write these slides were Marp and uh Mermaid.

s14
00:00:57.400 --> 00:01:00.280
And I'm going to talk to you about MCP Gateways.

s15
00:01:00.280 --> 00:01:03.920
But, I'm really going to be talking to you about AI safety.

s16
00:01:03.920 --> 00:01:15.560
So, I'm going to kind of go through sandboxes, gateways, harnesses, and sort of motivate why we're talking about AI safety at Docker right now.

s17
00:01:15.560 --> 00:01:22.560
So, like probably the last 6 months has been similar for all of you as it's been for me.

s18
00:01:22.560 --> 00:01:28.360
Agents are doing way more than I thought they were doing uh than I thought they were going to do.

s19
00:01:28.360 --> 00:01:32.840
And I'm no longer going to sit in front of my laptop and say, "Yes.

s20
00:01:32.840 --> 00:01:33.600
Yes.

s21
00:01:33.600 --> 00:01:34.560
Yes.

s22
00:01:34.560 --> 00:01:35.520
Yes."

s23
00:01:35.520 --> 00:01:39.960
They're doing longer running things, and I like that.

s24
00:01:39.960 --> 00:01:54.160
And as I get more and more accustomed to them doing longer running things, I sort of decide that my metric for me having designed a problem that an agent can sink its teeth into

s25
00:01:54.160 --> 00:01:58.200
is that I don't really need to give it a lot of supervision.

s26
00:01:58.200 --> 00:02:05.160
But if I'm not going to supervise it, maybe I'm also a little bit worried about what it's going to get up to.

s27
00:02:05.160 --> 00:02:11.680
So I think just to set context, this is what I think is so the sort of shape of the problem right now.

s28
00:02:11.680 --> 00:02:17.600
We need to talk about agent harnesses, what the what the agent harnesses do for us.

s29
00:02:17.600 --> 00:02:20.120
We need to talk about sandboxes.

s30
00:02:20.120 --> 00:02:26.560
Like when a agent harness delivers work, what is the what is the thing it delivers work into?

s31
00:02:26.560 --> 00:02:33.640
And then of course we've got MCPs, which which everybody knows, and we'll talk a little bit more about what we're doing there.

s32
00:02:33.640 --> 00:02:36.280
But let's start with the agent harness.

s33
00:02:36.280 --> 00:02:48.280
So I I mean it's it would be an oversimplification to say that an agent harness is something which just takes in context and emits tool calls.

s34
00:02:48.280 --> 00:02:50.959
But there's also a little bit of truth to that.

s35
00:02:50.959 --> 00:02:53.120
It's not the most complex part of it.

s36
00:02:53.120 --> 00:03:01.239
It's a loop that takes in some context that you give it and asks you to do something on its behalf.

s37
00:03:01.239 --> 00:03:06.800
But belaying that simplicity, we get we're all using a lot of different harnesses.

s38
00:03:06.800 --> 00:03:11.880
And the inter the ability to why why do we pick up different harnesses all the time?

s39
00:03:11.880 --> 00:03:17.120
Like we love the new sort of interactive interactive possibilities that they bring us.

s40
00:03:17.120 --> 00:03:21.360
So let's just admit right from the beginning, we're going to be using a lot of harnesses.

s41
00:03:21.360 --> 00:03:22.840
They're going to evolve pretty quickly.

s42
00:03:22.840 --> 00:03:27.000
We're going to be swapping in different harnesses for one another.

s43
00:03:27.000 --> 00:03:32.120
But a harness by itself is just kind of in a little bit of a dead room.

s44
00:03:32.120 --> 00:03:35.840
Like uh hello, someone give me some context.

s45
00:03:35.840 --> 00:03:38.120
Some somebody give me something to do.

s46
00:03:38.120 --> 00:03:42.040
This is where this is of course where MCPs come in.

s47
00:03:42.040 --> 00:03:45.440
MCPs allow us to do new things.

s48
00:03:45.440 --> 00:03:55.120
They allow us to go outside of ourselves, pull in new context, pull in new tools, and and get actual work done.

s49
00:03:55.120 --> 00:04:06.280
So, I think it's when you're trying to think about safety, I don't think it's an oversimplification to say that one of the things that you need to do is figure out what are the resources

s50
00:04:06.280 --> 00:04:08.760
that you need to do your job.

s51
00:04:08.760 --> 00:04:16.400
Like anytime, even for us, one of the first things you'd analyze when you want to do a new task is what do I need to get this tasks done?

s52
00:04:16.400 --> 00:04:18.400
What information do I need?

s53
00:04:18.400 --> 00:04:21.320
What tools do I need to actually get this done?

s54
00:04:21.320 --> 00:04:33.240
And if you knew that the sandbox that you built had the right resources, had the right tools, and only the right those resources and tools, it would make you feel safer.

s55
00:04:33.240 --> 00:04:39.680
It would make you feel like you limited the blast radius for what could go wrong when that agent is working.

s56
00:04:39.680 --> 00:04:43.040
So, this is kind of where sandboxes come in.

s57
00:04:43.040 --> 00:04:47.200
Sandbox is a place for an agent to do to do work.

s58
00:04:47.560 --> 00:04:55.840
So, our typical sandboxes today, you're most of us are accustomed to the Yeah, we have code sandboxes.

s59
00:04:55.840 --> 00:04:57.840
We give it We give it a bunch of code.

s60
00:04:57.840 --> 00:04:59.919
We give it all the tools on our laptop.

s61
00:04:59.919 --> 00:05:06.480
Maybe like when you first started using some of these agents, the sandbox was your entire laptop.

s62
00:05:06.680 --> 00:05:11.880
As over time, we're starting to learn how to get that a bit smaller.

s63
00:05:11.880 --> 00:05:20.480
We're trying to make the sandbox boundaries small enough that they can actually just do the task that we want to do want them to execute.

s64
00:05:20.480 --> 00:05:30.840
That helps us feel safer about letting the agent run for longer periods of time if this if the sandboxes is a little is is is smaller.

s65
00:05:30.840 --> 00:05:37.440
And you know, it's not that we're trying to sandbox the harness itself.

s66
00:05:37.440 --> 00:05:39.400
The harness is kind of already sandboxed.

s67
00:05:39.400 --> 00:05:41.520
Like it's a it's a pretty simple thing.

s68
00:05:41.520 --> 00:05:47.880
We're trying to harness the tools and the context that are flowing into this harness.

s69
00:05:47.919 --> 00:05:54.760
So, in order to kind of illustrate some of these concepts, I came up with two stories that I'm I'm just going to walk you through.

s70
00:05:54.760 --> 00:05:59.000
The first one is um a newsroom analogy.

s71
00:05:59.000 --> 00:06:07.520
So, if you've got a newspaper reporter, they go out in the world, they find cool stories, find cool information, they bring it back.

s72
00:06:07.520 --> 00:06:17.640
Maybe someone inside of that agent agency uh look it does some fact-checking on that, make sure the information is right, and then you write a story.

s73
00:06:17.640 --> 00:06:22.640
It's totally natural that those roles are completely separate.

s74
00:06:22.640 --> 00:06:29.240
The actual reporter is not going to be allowed to like publish to the website or or or write write the actual article.

s75
00:06:29.240 --> 00:06:31.080
We we break those up.

s76
00:06:31.080 --> 00:06:34.840
That's actually how we already build complicated systems.

s77
00:06:34.840 --> 00:06:37.560
We split them up into little pieces.

s78
00:06:37.560 --> 00:06:43.000
So, on this slide, what you see is I've broken down three sandboxes in blue here.

s79
00:06:43.000 --> 00:06:47.960
So, we've got a researcher, we've got a fact-checker, and we've got a reporter.

s80
00:06:47.960 --> 00:06:52.160
So, that researcher sandbox, I think I think about that as the reporter.

s81
00:06:52.160 --> 00:06:56.320
Now, when we define that sandbox, let it access the web.

s82
00:06:56.320 --> 00:07:05.880
Let it access as much of the as much of the internet as we want because we're not going to give it the MCPs that it can like write to our our corporate site.

s83
00:07:05.880 --> 00:07:08.040
It can't publish anything.

s84
00:07:08.040 --> 00:07:14.280
We're just going to let it do we're just going to let it go out, go crazy, do research.

s85
00:07:14.280 --> 00:07:17.120
So, our sandbox is like, "Yeah, not too many tools.

s86
00:07:17.120 --> 00:07:21.360
I'm not going to give you too much write access, but definitely do lots of research.

s87
00:07:21.360 --> 00:07:29.000
Just write your research out to a I don't know, to some temp directory, some private thing that is local to this agent."

s88
00:07:29.000 --> 00:07:34.200
A fact-checker is going to need some MCPs, but it's not going to need any network.

s89
00:07:34.200 --> 00:07:35.800
So, then let's start the fact-checker up.

s90
00:07:35.800 --> 00:07:37.400
Let's put that in a different sandbox.

s91
00:07:37.400 --> 00:07:40.120
Let's say no network.

s92
00:07:40.200 --> 00:07:44.640
Yeah, and you can read the research that's been done for you, and you can fact-check it.

s93
00:07:44.640 --> 00:07:47.560
And you can have access to our our fact database.

s94
00:07:47.560 --> 00:07:49.200
You know, filter that out.

s95
00:07:49.200 --> 00:07:53.280
And then finally, we get to the little blue thing on the right.

s96
00:07:53.280 --> 00:07:57.720
And this certainly doesn't need any any access to networks.

s97
00:07:57.720 --> 00:08:06.800
In fact, it shouldn't have any, but we do want to give it our notion MCP or our publisher MCP because it's just looking at filtered research.

s98
00:08:06.800 --> 00:08:15.640
So, you know, look at this whole slide, draw a box around this entire slide, and that effective agent has a bunch of MCPs.

s99
00:08:15.640 --> 00:08:19.840
Maybe it has an MCP for publishing, it has an MCP for fact-checking.

s100
00:08:19.840 --> 00:08:23.840
At one point in time, it has access to the entire internet.

s101
00:08:23.840 --> 00:08:35.680
But we break it up into logical sandboxes, so at each individual point, we have a don't have a dangerous concept a dangerous combination of both being able to read in crazy

s102
00:08:35.680 --> 00:08:40.560
unfiltered context and do things with our tools.

s103
00:08:40.800 --> 00:08:44.800
So, let's look at example number two.

s104
00:08:44.800 --> 00:08:52.680
And I'm just going to talk about uh building a Actually, this is how I I build my coding agent right now.

s105
00:08:52.680 --> 00:08:58.839
I tend to send the the coding agent off to do pretty long-running tasks.

s106
00:08:58.839 --> 00:09:03.520
And let's just say that they work for about an hour.

s107
00:09:03.520 --> 00:09:11.200
But as the as the work is happening, I also like it if it just does commits along the way.

s108
00:09:11.200 --> 00:09:15.960
But the ratio of the amount of time that it's my agent is actually committing is almost nothing.

s109
00:09:15.960 --> 00:09:24.880
In an In an hour, it might be it might need, say, my my my Git signing keys for like 2 minutes of that time.

s110
00:09:24.880 --> 00:09:28.760
And when I'm committing, I need to see my my Git commit tree.

s111
00:09:28.760 --> 00:09:30.000
I need to make that commit.

s112
00:09:30.000 --> 00:09:33.320
I need some signing keys, but I don't need anything else.

s113
00:09:33.320 --> 00:09:44.680
So, I would like it if the actual sandbox that an agent is running a task in is modeled after the intent of what I'm doing.

s114
00:09:44.680 --> 00:09:52.800
So, if I'm not going to make a commit, I don't want my commit signatures, my commit signing keys inside that sandbox.

s115
00:09:52.800 --> 00:09:57.160
And I think this this you can map across a lot of different tasks.

s116
00:09:57.160 --> 00:10:07.600
If you know the if your agents know the intent of what you're trying to do, then use that intent to model the capabilities that you give to that.

s117
00:10:07.600 --> 00:10:18.480
So, this is driving in in our our Docker sandbox product, this is defining a lot of how we're thinking about exposing things like an MCP gateway.

s118
00:10:18.480 --> 00:10:24.360
So, when you build a sandbox, of course you have to put a harness in in that to do things for you.

s119
00:10:24.360 --> 00:10:30.360
And then we're just putting a little gateway endpoint into that.

s120
00:10:30.360 --> 00:10:34.440
And that gateway endpoint funnels all MCP traffic.

s121
00:10:34.440 --> 00:10:54.560
So, imagine it's something like MCP an internal an an internal URL mcp.gateway.docker.internal or something like this that every single agent harness has and all traffic, all resources that you need to pull in, all tool calls move through this one

s122
00:10:54.560 --> 00:10:57.360
this one single gateway.

s123
00:10:57.600 --> 00:10:58.480
So, what does this buy us?

s124
00:10:58.480 --> 00:11:01.920
Well, we end up with a control point.

s125
00:11:01.920 --> 00:11:06.760
So, the gateway manages which tools, resources, and prompts are given to each sandbox.

s126
00:11:06.760 --> 00:11:12.600
So, you're starting to see the beginnings of your ability to say, "Okay, I'm giving you a harness.

s127
00:11:12.600 --> 00:11:14.760
I'm giving you this gateway endpoint.

s128
00:11:14.760 --> 00:11:23.720
The gateway this the configuration of the sandbox controls what you can do inside of that sandbox with things like MCP."

s129
00:11:23.720 --> 00:11:29.200
Another nice thing is suddenly all your harnesses are MCP agnostic.

s130
00:11:29.200 --> 00:11:36.600
So, you don't have to go to codex and configure your MCPs one way and go to uh cloud code and configure your MCPs one way.

s131
00:11:36.600 --> 00:11:41.600
You just have one you almost make the harness a parameter of the sandbox.

s132
00:11:41.600 --> 00:11:49.400
Stick a harness in, stick the MCPs you need in, give it some network rules, Bob's your uncle.

s133
00:11:49.760 --> 00:11:56.320
So it's it feels the MCP MCP is is a good place to manage things like credentials.

s134
00:11:56.320 --> 00:12:05.320
In fact, I would say that a maxim that you can use here is how many credentials should be in uh a sandbox.

s135
00:12:05.320 --> 00:12:08.960
Well, I mean the the the right answer is always zero.

s136
00:12:08.960 --> 00:12:12.080
It just they should just never be in there.

s137
00:12:12.080 --> 00:12:24.600
And the blast radius of an agent going doing something going going uh doing something incorrect, if there are absolutely no no credentials in there, is is reduced.

s138
00:12:24.600 --> 00:12:34.280
So one of the things that um Docker, Entropic, Octo are all partnering on is a is a new thing called XAA, cross app application.

s139
00:12:34.280 --> 00:12:43.760
And I think this is a really great illustration of why sandboxes and um and managing credentials in this way is important.

s140
00:12:43.800 --> 00:12:53.680
So today in your well you're you're working at at at your companies, you have some sort of identity management, you have SSO set up, and you've got all these

s141
00:12:53.680 --> 00:12:58.000
resource servers that that manage that that that you work with for OAuth.

s142
00:12:58.000 --> 00:13:03.440
It could be Notion or it could be Atlassian or GitHub or Slack.

s143
00:13:03.440 --> 00:13:07.440
They're you've already configured SSO for those.

s144
00:13:07.440 --> 00:13:11.800
But it's not yet accessible to your agent.

s145
00:13:11.880 --> 00:13:28.640
So with a cross app application scenario, your harness, your your your sandbox, and your gateway can define things like agent identity or who are you that this agent is behaving on behalf of?

s146
00:13:28.640 --> 00:13:42.560
And by extension by exchanging identity claims with your identity provider, which is already there, you can get back a new thing, which is a new part of this spec that you you'll now see in the latest version of MCP,

s147
00:13:42.560 --> 00:13:46.840
called an ID jag, an authorization grant.

s148
00:13:46.840 --> 00:13:57.600
And with that authorization grant, we're granting access to this act to the to this actor to this agent to the same authorization servers that you've been using.

s149
00:13:57.600 --> 00:13:58.600
There's nothing new here.

s150
00:13:58.600 --> 00:14:09.520
We're not We're leveraging all this existing investment that these corporate internet corporate networks already have, but suddenly, without any crazy consent screens, yeah, you can do that.

s151
00:14:09.520 --> 00:14:10.280
Yeah, you do that.

s152
00:14:10.280 --> 00:14:11.360
Yeah, you can do that.

s153
00:14:11.360 --> 00:14:18.640
We can centralize the administration of what an agent now does with all these existing resource servers.

s154
00:14:18.640 --> 00:14:21.880
It's a great It's a huge simplification.

s155
00:14:23.280 --> 00:14:30.880
So, the MCP gateways, I like to think are we're starting to talk about progressive disclosure, which is a term we learned from from skills.

s156
00:14:30.880 --> 00:14:42.240
I like to think we're starting to use this now we're able to progressively disclose tools and resources and MCPs into these sandboxes using very, very similar principles.

s157
00:14:42.240 --> 00:14:46.080
And of course, it's amazing because we keep contact size down.

s158
00:14:46.080 --> 00:14:56.120
Just because you might at some point in a workflow use 50 different MCPs, doesn't mean that each sandbox has to have all 50 of those MCPs.

s159
00:14:56.120 --> 00:15:03.640
Give your agents room to solve problems, but let individual sandboxes represent the intent of the task.

s160
00:15:03.640 --> 00:15:08.360
Let them represent what you're actually trying to do in this task.

s161
00:15:08.960 --> 00:15:16.480
So, I like this picture because suddenly we start to think about orchestrators as one of their jobs is to go, "Well, what am I doing?

s162
00:15:16.480 --> 00:15:18.000
What's my task?

s163
00:15:18.000 --> 00:15:21.320
And I need to put a task into a sandbox.

s164
00:15:21.320 --> 00:15:23.680
So, what sandbox do I put it in?

s165
00:15:23.680 --> 00:15:26.880
What capabilities does this need?

s166
00:15:26.880 --> 00:15:28.840
And of course, it needs a harness.

s167
00:15:28.840 --> 00:15:29.920
Like, what do you put in?

s168
00:15:29.920 --> 00:15:30.680
Open code?

s169
00:15:30.680 --> 00:15:31.720
Put in Claude?

s170
00:15:31.720 --> 00:15:32.560
Put in Gemini?

s171
00:15:32.560 --> 00:15:33.960
Put in Codex?

s172
00:15:33.960 --> 00:15:35.880
It's going to need some MCPs.

s173
00:15:35.880 --> 00:15:40.600
Take a look at the task, decide what MCPs are allowed to be used in this.

s174
00:15:40.600 --> 00:15:43.320
Um what networking rules should you apply?

s175
00:15:43.320 --> 00:15:46.480
Does this need access to api.github.com?

s176
00:15:46.480 --> 00:15:49.480
Does it need access to surf the web in in in random ways?

s177
00:15:49.480 --> 00:15:51.720
Or does it just need nothing?

s178
00:15:51.720 --> 00:15:52.600
What resources?

s179
00:15:52.600 --> 00:15:54.240
What work trees?

s180
00:15:54.240 --> 00:16:09.800
We get used to thinking about modeling capabilities, building the right sandbox for the task, putting the task in, and now we're starting to see that this individual loop is safer because it has less access

s181
00:16:09.800 --> 00:16:13.200
than the entire workflow effectively has.

s182
00:16:13.200 --> 00:16:16.080
So, this is um this is about containers.

s183
00:16:16.080 --> 00:16:23.880
This is about containerizing agents, which is why uh I guess this is why we're at I'm I'm at Docker.

s184
00:16:23.880 --> 00:16:27.360
But this ties together as a kind of like role separation.

s185
00:16:27.360 --> 00:16:30.320
What are the roles that you that your agents have?

s186
00:16:30.320 --> 00:16:37.000
How do you map them and containerize them and and make sure that you're giving them sandboxes that express that intent.

s187
00:16:37.000 --> 00:16:41.800
Never have any any creds anywhere in any in any harnesses.

s188
00:16:41.800 --> 00:16:46.880
Disclose capabilities progressively into agents as they need them.

s189
00:16:46.880 --> 00:16:51.920
The sandboxes for you are are are what actually represent intent.

s190
00:16:51.920 --> 00:17:00.600
And if we allow some of these things to run longer, but they're more sandboxed, we feel a little bit safer about that.

s191
00:17:00.600 --> 00:17:02.800
That's this is where safety comes from.

s192
00:17:02.800 --> 00:17:05.240
So, we have a demo.

s193
00:17:05.240 --> 00:17:10.640
Our our EVP of of engineering, Tushar Jain, is I got to talk upstairs today.

s194
00:17:10.640 --> 00:17:15.720
I think it's at 4:00, and he's taking a lot of these ideas and just demo demo demo.

s195
00:17:15.720 --> 00:17:18.720
How do you make move sandboxes to the cloud?

s196
00:17:18.720 --> 00:17:19.920
How do you build orchestrators?

s197
00:17:19.920 --> 00:17:22.880
He'll be really showing a lot of these things live.

s198
00:17:22.880 --> 00:17:25.400
We also have a booth over here.

s199
00:17:25.400 --> 00:17:29.200
Um it's a great opportunity to come over if you're interested in any of this stuff.

s200
00:17:29.200 --> 00:17:31.760
We can show you the command line that's available today.

s201
00:17:31.760 --> 00:17:34.600
Anyone uh just brew install sbx.

s202
00:17:34.600 --> 00:17:38.640
That Everything I've been talking about today is this tool sbx.

s203
00:17:38.640 --> 00:17:42.280
This is This is how we build we build containers.

s204
00:17:42.280 --> 00:17:47.640
Um so yeah, please please uh please come over and talk to us at the booth.

s205
00:17:47.640 --> 00:17:53.560
We'd uh we'd love to hear what you're uh what you're doing with AI safety and how we might be able to help.

s206
00:17:53.560 --> 00:17:55.522
But uh thank you very much.

s207
00:17:55.522 --> 00:17:57.522
[applause]

s208
00:18:11.242 --> 00:18:13.242
[music]