Running AI agents in GitHub Actions with Docker Sandboxes

Summary

GitHub Agentic Workflows added support for Docker Sandboxes as an agent runtime, allowing CI coding agents to operate within microVM isolation. Useful AI agents require broad capabilities like executing arbitrary shell commands and launching containers, which elevates risk on shared CI runners. With the docker-sbx runtime, agents receive root privileges and a private Docker daemon inside a dedicated microVM while external repository access and network traffic remain restricted. In a demonstration, an agent ran on an Ubuntu runner, executed Java 21 integration tests with PostgreSQL via Testcontainers, identified an email case-sensitivity defect, applied a code fix, and opened a draft pull request. The complete workflow executed in eleven minutes and sixteen seconds while confining modifications strictly to source files.

Context

Useful AI coding agents execute arbitrary shell commands, install tools, and launch containers, which increases the blast radius of potential mistakes on standard CI runners.

Approach / What changed

Integrating Docker Sandboxes into GitHub Agentic Workflows isolates the agent inside a disposable microVM featuring its own kernel, network stack, private Docker daemon, and safe-output boundaries for pull requests.

Takeaways

• Docker Sandboxes isolate AI agents inside a dedicated microVM with its own kernel, network stack, and private Docker daemon, avoiding access to the host daemon.
• GitHub Agentic Workflows compiles Markdown task files containing YAML frontmatter into conventional GitHub Actions lock files using the gh-aw extension.
• Safe-output configuration jobs can strictly enforce boundaries by restricting generated pull request patches to specific path patterns like src/**.

Related reading

• Docker · May 18, 2026

  Coding Agent Horror Stories: The Security Crisis Threatening Developer Infrastructure

  Autonomous AI coding agents increasingly handle developer workflows, but their execution model introduces critical security risks. Operating with the executing user's full permissions, these agents can read ambient secrets, inherit cloud credentials, and run destructive shell commands without human intervention. Documented incidents between October 2024 and February 2026 reveal systemic hazards, including unintentional home directory deletions and increased security vulnerabilities in generated code. To address these vulnerabilities, Docker Sandboxes isolate agent execution within dedicated microVMs, preventing access to the host filesystem and blocking common credential paths by default. Routing changes through Git worktrees and restricting network egress ensures that agent actions remain strictly bounded and reviewable before affecting main branches or production infrastructure.

  Jennifer Kohl

• Github · Jul 8, 2026