Containers have been the unit of nearly everything Docker ships for over a decade, and a sandbox might sound like one more way to package a workload. A container is an isolated process that shares the host kernel with everything else on the machine.
Docker Sandboxes are dedicated microVMs with their own Linux kernel, filesystem, network, and Docker Engine, built for autonomous coding agents that need a whole development machine to work in. A sandbox can run containers, which is part of why the two are easy to conflate.
In his WeAreDevelopers keynote, Docker President Mark Cavage said containers are doing exactly the job they were designed to do, but we're asking them to do a different job. Containers were built to isolate applications, which they still do well.
But a coding agent is an actor: it makes decisions and operates on your systems the way a developer uses a laptop. It clones repositories, installs packages, starts databases, builds images, and tries again for hours. It can also act on instructions from files, web pages, and tool output that nobody reviewed.
