Running AI agents in GitHub Actions with Docker Sandboxes

Summary

GitHub Agentic Workflows added support for Docker Sandboxes as an agent runtime, allowing CI coding agents to operate within microVM isolation. Useful AI agents require broad capabilities like executing arbitrary shell commands and launching containers, which elevates risk on shared CI runners. With the docker-sbx runtime, agents receive root privileges and a private Docker daemon inside a dedicated microVM while external repository access and network traffic remain restricted. In a demonstration, an agent ran on an Ubuntu runner, executed Java 21 integration tests with PostgreSQL via Testcontainers, identified an email case-sensitivity defect, applied a code fix, and opened a draft pull request. The complete workflow executed in eleven minutes and sixteen seconds while confining modifications strictly to source files.

Takeaways

1. 1

   Docker Sandboxes isolate AI agents inside a dedicated microVM with its own kernel, network stack, and private Docker daemon, avoiding access to the host daemon.

2. 2

   GitHub Agentic Workflows compiles Markdown task files containing YAML frontmatter into conventional GitHub Actions lock files using the gh-aw extension.

3. 3

   Safe-output configuration jobs can strictly enforce boundaries by restricting generated pull request patches to specific path patterns like src/**.