YOLO Mode, Safely: MicroVM Sandboxes for Any Agent — Rowan Christmas, Docker

Rowan Christmas, a product manager at Docker, gave this talk at the AI Engineer World's Fair 2026 in San Francisco. It opens with an experiment: he tried to hack himself using his own coding agent, and five prompts later it had turned up his browser history, his bank accounts and more.

After short intros (0:00, 0:12), the chapter at 0:27 introduces Docker Sandboxes, run with the sbx command. At 0:52 he asks whether a coding agent's own safeguards protect you, then tells the self-hacking story from 1:22, including the security team's alert at 2:32 and the five-prompt recap at 3:22.

The case for microVMs starts at 3:47. According to the description, one sbx command starts an isolated VM with its own kernel, filesystem isolation, placeholders in place of real secrets, networking that denies by default, and a full audit trail. The chapter at 5:07 compares running claude directly with sbx run claude, and at 5:47 the same attack is repeated inside the sandbox. Outbound network traffic blocked by default is the subject of 6:12, and a short chapter at 6:47 covers Docker's own developers coding in sandboxes.

At 7:07 he explains why guardrails inside the agent tool itself are not enough. He then previews agent identity and delegation chains (7:52) and governance controls (8:46), which the description lists as network allow and deny rules, filesystem rules and MCP catalogs. Upcoming L7 and per-repo controls are covered at 9:11.

The practical part comes near the end: installing sbx and running any agent at 9:46, then read-only mounts for related repositories at 10:31, before a wrap-up at 10:56. The description says the sandbox works with Claude Code, Codex or other agents.

Pricing and platform support are not stated in the sources. The description links the product page, the documentation and the sbx releases on GitHub, which is the place to check before installing.