Bản viết lại dựa trên nguồn: https://www.docker.com/blog/harbor-docker-sandboxes-run-safe-reproducible-agent-evals/
Harbor + Docker Sandboxes: Run Safe, Reproducible Agent Evals | Docker Skip to content Products AI and Agents Docker Sandboxes New Isolated environments for coding agents AI Governance New Govern agents and Claws across every team MCP Enterprise Gateway Connect and manage MCP tools Gordon Your AI Agent across Docker Docker Model Runner Local-first LLM inference made easy Application Security Docker Hardened Images Ship with secure, enterprise-ready images Docker Scout Simplify the software supply chain Application Development Docker Desktop Containerize your applications Docker Hub Discover and share container images Docker Offload Break free of local constraints Support Developers Documentation Find guides for Docker products Getting Started Learn the Docker basics Resources Search a library of helpful materials Training Skill up your Docker knowledge Extensions SDK Create and share your own extensions Community Connect with other Docker developers Open Source Explore open source projects Preview Program Help shape the future of Docker Customer Stories Get inspired with customer stories Onboarding Get started with Docker Onboarding Get the latest Docker news Pricing Yearly Monthly Docker Personal $0 $0 For individual developers who need the essential tools to build and deploy containers. Get started Get started Docker Pro $11 $9 per user/month For individual professionals who require more advanced features and additional resources. Buy now Buy now MOST POPULAR Docker Team $16 $15 per user/month For small teams that need collaborative tools to make working together more efficient. Buy now Buy now Docker Business $24 $24 per user/month For enterprises desiring robust security, control, and compliance features. Buy now Buy now Contact sales Contact sales Docker Hardened Images (DHI) Secure, minimal container images for every team, free with enterprise features, if needed. Start Free Trial BlogDocs Search Sign In Contact Sales Toggle menu Harbor + Docker Sandboxes: Run Safe, Reproducible Agent Evals Posted Oct 14, 2026 Srini Sekaran, Sohan Patil, and John Mu Key takeaways Harbor can now run every eval task in Docker Sandboxes Docker Sandboxes are MicroVM environments to run agents like Claude Code, Codex, Cursor, and more safely With Sandboxes, define custom network policies for fair, reproducible evals Run your evals locally or in the cloud: starting for free on Docker Sandboxes on local surfaces and scaling to Cloud Sandboxes To evaluate an agent, you give it a real task, let it work, and check the result. Along the way, the agent installs packages, edits files, and runs commands. That’s untrusted, AI-written code, and a benchmark runs it thousands of times. And agents don’t always play fair. An agent can sometimes earn a passing score on an eval by gaming the check instead of doing the work, for example by tampering with tests or overwriting the file that records its score. This is called reward hacking, and it’s a growing concern across the eval community. So running agent evals needs two things: An eval framework that runs each task, lets the agent work, checks the result, and collects the scores and logs. An environment for every task that’s clean and isolated, so evaluating agents is safe and consistent. Harbor gives you the first. It’s an open-source eval framework. Give it a benchmark like Terminal-Bench, and it simplifies the process of running evals. Now, Docker Sandboxes gives you the second: a safe way to run those eval tasks, on your laptop or in the cloud. Here’s what this means for you Strong isolation by default. Docker Sandboxes were designed from the ground up for deeper isolation. This means you can run every task in a microVM, not a shared container. A microVM has its own kernel, so whatever the agent does stays inside its sandbox. It can’t break out to reach your machine, other tasks, or anything else outside its environment. Fair, reproducible evals. With Docker Cloud Sandboxes, configurable network policies let a task download dependencies during setup, then restrict internet access while the agent works. This way, every agent can be tested under the same conditions. Parallel runs, no machines to manage. With Docker Cloud Sandboxes, teams can run many tasks at once without needing to manually provision anything. Run dozens of concurrent workers simultaneously.* Develop locally, scale in the cloud. The same tasks run locally or in Docker Cloud Sandboxes. Build on your laptop, then run your tasks in the background, and at scale, without changing anything. Try it Install Harbor with Docker Sandboxes. uv tool install "harbor[sbx]" Activate Cloud access for your Docker account and create a personal access token. Select Cloud Sandboxes under access permissions. Copy and save your token. It’s shown only once. Set your Docker ID (your Docker login username) and PAT (personal access token), then run a task in Cloud Sandboxes. export SBX_DOCKER_USERNAME="your-docker-id" export SBX_DOCKER_PAT="your-personal-access-token" harbor run -t hello-world/hello-world -a oracle -e sbx To run locally, install the Docker Sandboxes CLI, run sbx login, and add –ek target=local to the command above. Harbor’s local integration currently supports public and no-network modes, subject to the machine’s existing sandbox policy. This integration is available today on the nightly release of Docker Sandboxes. uv tool install –upgrade "harbor[sbx]==0.24.1.dev202610150414"It’ll be available in the stable release on 10/23. Docker Compose is supported as part of the release, which means Harbor can run multi-container tasks inside a single Docker Cloud Sandbox, so services and sidecars can share that MicroVM. To learn more, see the Docker Sandboxes docs and the Harbor docs. *We’ve tested Harbor with 64 concurrent tasks on Docker Cloud Sandboxes. For higher limits, we’re happy to help: contact us. About the Authors Srini Sekaran Principal Product Marketing Manager for AI, Docker Srini Sekaran is Principal PMM for AI at Docker, focused on Docker AI Governance, Docker Sandboxes, and the future of agent infrastructure and developer workflows. Sohan Patil Sr Software Engineer, Docker John Mu Staff Software Engineer, Docker AI/ML Docker Sandboxes Products Table of contents Related Posts Sep 24, 2026 Manufacturing Trust for AI Agents | Docker’s WeAreDevelopers Keynote Docker’s WeAreDevelopers keynote shows how Sandboxes, Kits, and Cloud Sandboxes give AI agents strong isolation and reproducible authority. Deanna Sparks Read now Oct 14, 2026 AI Agent Security Risks: What Can Go Wrong When Agents Act on Their Own Learn the top AI agent security risks, from prompt injection to excessive autonomy and credential exposure, and how to contain them. Eric Jia and Srini Sekaran Read now Oct 14, 2026 Harbor + Docker Sandboxes: Run Safe, Reproducible Agent Evals Harbor can now run every eval task in Docker Sandboxes Docker Sandboxes are MicroVM environments to run agents like Claude Code, Codex, Cursor, and more safely With Sandboxes, define custom network policies for fair, reproducible evals Run your evals locally or in the cloud: starting for free on Docker Sandboxes on local surfaces and scaling… Srini Sekaran, Sohan Patil, and John Mu Read now Oct 12, 2026 Docker Hub security advisory: personal access tokens transferred during account-to-organization conversions CVE-2026-105445: Docker Hub account conversion could re-assign personal access tokens to a new owner. Read what happened, who was affected, and the fix. Mark Lechner Read now Products Products Overview Docker Desktop Docker Hub Docker Scout Docker Hardened Images Docker Sandboxes AI Governance MCP Enterprise Gateway Features Command Line Interface IDE Extensions Container Runtime Docker Extensions Trusted Open Source Content Secure Software Supply Chain Developers Documentation Getting Started Trainings Extensions SDK Community Open Source Preview Program Newsletter Pricing Personal Pro Team Business Premium Support and TAM Pricing FAQ Contact Sales Company About Us What is a Container Blog Why Docker Trust Customer Success Partners Events Docker System Status Newsroom Swag Store Brand Guidelines Trademark Guidelines Careers Contact Us Languages English 日本語 © 2026 Docker Inc. All rights reserved Terms of Use Privacy Legal Cookie Settings