Docker Sandboxes + BAND AI: isolate local agent work

The appeal of the setup, as the Docker post frames it, is architectural rather than about model capability: the place where work is received and the place where hands actually move are separated. A room can route a request to a local worker without handing that worker the entire repository. Being able to identify where a request came from is not the same as that request carrying execution authority, so a design that treats every room participant as a deployment approver is a mistake.

On isolation, Docker Sandboxes uses microVMs. Mounting a workspace directly means changes propagate to the host, while clone mode reads the host repository read-only and keeps a working clone inside the VM; stopping preserves state and is not the same as deletion. Network limits likewise do not substitute for business authorization, and local MCP servers running on the host should not be assumed to sit inside the same boundary as processes in the VM.

Version hygiene is another practical snag. The October 21 Docker article's example pins BAND kit 6.0.0, whereas BAND's Docker Sandbox guide fixes the SDK and images at 3.1.1 and explains compatibility steps on sbx 0.43.0, with an echo bot as its initial sample. The offline Python example, which only converts an allowed request into an execution plan and returns it for human review, is explicitly not a connection test to BAND or Docker. It also notes that a fixed command is not automatically safe, since unittest loads and runs the target project's Python code.