Which should you use, local Docker or a cloud sandbox?
It depends on whose code it is. For code you did not write, such as an agent's commands or a user's upload, a cloud sandbox keeps it off your laptop. Runtime runs each one as a Firecracker microVM for $0.03125 an hour while it waits. A cloud sandbox also runs many at the same time, keeps running after your laptop is closed, and gives you a link to share. Pick local Docker for your own code and services, for fast iteration on a project you trust, and for anything that must stay on your machine.
What a local container shares with you
Docker's defaults are made for your own trusted software. For code a model wrote, each default is something the code can reach:
| What | Local Docker, as Docker documents it |
|---|---|
| Kernel | On Linux, your machine's. Docker Desktop "runs the Docker Engine inside a lightweight Linux virtual machine" |
| Files | "Bind mounts have write access to files on the host by default", unless mounted ro |
| CPU and memory | "By default, a container has no resource constraints", until you pass --memory and --cpus |
| Network | Whatever you give it; --network none leaves "only the loopback device" |
| The daemon | "Requires root privileges unless you opt-in to Rootless mode"; "only trusted users should be allowed to control your Docker daemon" |
| Your keys | Anything you pass in -e or mount is readable by the code |
Docker says of bind mounts that "you can change the host filesystem via processes running in a container, including creating, modifying, or deleting important system files or directories." Mounting a project so the agent can edit it is exactly that.
Docker also offers Docker Sandboxes. They run coding agents in isolated environments on your machine or on Docker-managed cloud infrastructure. A local sandbox is a microVM with a "separate kernel per sandbox", and its outbound TCP traffic is "governed by a deny-by-default policy".
What changes in a cloud sandbox
| Concern | Local Docker | Runtime sandbox |
|---|---|---|
| Where the code runs | Your laptop or build server | A microVM on dedicated servers Runtime operates |
| Your files | Reachable through whatever you mount | Only what you upload; results come back with files.download |
| Your network | What you configure; --network none for none |
Private and internal addresses refused; allow and deny lists on top |
| API keys | Visible to the code | Secrets the sandbox never holds; the host's proxy adds them per host |
| Root inside | Maps to root on the host unless user namespaces are on | Root of the guest only; network, CPU, memory and cost set on the host |
| Many at once | As many as your machine fits | 4 without credit; 100 paid |
| Laptop closed | Everything stops | Runs on, or pauses with memory and processes while you have credit |
| Showing someone | A tunnel you set up | A preview URL for any port, private with a token by default |
| Cost | Your own hardware and power | $0.025 per active vCPU-hour, $0.0075 per GiB-hour |
Docker's user namespace remapping, which changes the root row, is off until you enable it on the daemon.
What it costs
Local Docker's cost is the machine you already own. A Runtime sandbox with 2 vCPU and 4 GiB costs the following per hour, and per working month of 8 hours a day for 21 days:
| Use | Per hour | 168 hours |
|---|---|---|
| Mostly waiting | $0.03125 | 168 × $0.03125 = $5.25 |
| Both CPUs busy | $0.08 | 168 × $0.08 = $13.44 |
| Paused | $0.00 compute | Storage at $0.08 per decimal GB per 30-day month |
The usage included every month applies first, with no card (pricing).
The Runtime equivalent
Send the project you would have mounted, run its Compose stack inside the sandbox, and bring the results back. The containers share the sandbox's kernel, not yours.
TypeScriptimport { mkdtemp, writeFile } from "node:fs/promises";import { tmpdir } from "node:os";import { join } from "node:path";import { Sandbox } from "withruntime";const project = await mkdtemp(join(tmpdir(), "agent-"));await writeFile(join(project, "main.py"), "print('built in the sandbox')\n");await using sbx = await Sandbox.create({ diskMiB: 8192 });await sbx.files.upload(project, "/workspace/project");await sbx.exec("sudo enable-docker", { check: true, timeoutMs: 300_000 });const run = await sbx.exec( "docker run --rm -v /workspace/project:/app -w /app python:3.12-slim python main.py", { timeoutMs: 300_000 },);console.log(run.stdout);await sbx.files.download("/workspace/project", join(project, "..", "agent-out"));Pythonimport pathlibimport tempfilefrom withruntime import Sandboxproject = pathlib.Path(tempfile.mkdtemp())(project / "main.py").write_text("print('built in the sandbox')\n")with Sandbox.create(disk_mib=8192) as sbx: sbx.files.upload(str(project), "/workspace/project") sbx.exec("sudo enable-docker", check=True, timeout_ms=300_000) run = sbx.exec( "docker run --rm -v /workspace/project:/app -w /app python:3.12-slim python main.py", timeout_ms=300_000, ) print(run.stdout) sbx.files.download("/workspace/project", str(project.parent / "agent-out"))The bind mount here writes to the sandbox's disk, which is thrown away with
it. docker compose up -d works the same way. A published port can be
forwarded to your machine with runtime sandboxes port-forward
(Docker).
Which one fits
- Local Docker for your own code and services, for fast iteration on a project you trust, and for anything that must stay on your machine.
- A cloud sandbox for code you did not write: an agent's commands, a model's answers, a user's upload. Also use one when you need many at the same time, a run that outlives your laptop, or a link to show someone the result.
More: run Docker in a sandbox, microVM vs container, Firecracker vs Docker, coding agent sandbox, preview agent-built apps.
Runtime Cloud
A Runtime sandbox takes the agent's code off your laptop. It costs $0.03125 an hour while it waits and $0.08 with 2 vCPUs busy. Every account gets 100 free hours of a 1 GB machine. Each sandbox is a Firecracker microVM with its own Linux kernel. Docker still works: it runs inside the sandbox.
Start from your terminal:
Terminalprintf '%s\n' 'print(sum([125, 250, 375]))' > invoice.pynpx withruntime sandboxes run -- python3 - < invoice.pyThe first run prints a link to approve in your browser. There is no API key to copy.
Start with the command above, on the free hours. If your agent already uses another sandbox provider, the migration guide moves its code over.
Sources
Checked 26 October 2026.
- Docker Engine security, bind mounts, resource constraints, the none network driver
- Docker Desktop networking
- Docker Sandboxes and its security model
- Runtime the sandbox environment, security, pricing and speed
Facts on this page were checked on 26 October 2026.