Support Docker Sandboxes ('non-local dev environments')

[LarsKemmann]

The recent spate of npm-based RAT/worm attacks has made it more important to invest in a blast-proof development environment—both for humans and agents.

Built-in guidance for Docker Sandbox usage could be tremendously helpful to newcomers. I learned about sbx from Andrew Lock's blog posts and have been working my way through the setup process, but for someone just getting started, it's not immediately obvious why sandboxes would be helpful or how setting them up differs from devcontainers.

[kiview]

Hey @LarsKemmann, I'm leading the sbx team at Docker, no affiliation with Aspire whatsoever, but maybe I can help 🙂
While you absolutely could run sbx sandboxes as a more isolated Devcontainers setup, it's not something we explicitly productize. So the default workflow is generally about using them together with coding agents.

As such, there is no specific Aspire setup that should be necessary. Just run a sbx sandbox with your specific coding agent (e.g. Claude Code), and let it run on your project. It will be able to install dependencies as needed. You can confirm more customization yourself, by using our Kits concept: https://docs.docker.com/ai/sandboxes/customize/kits/

[LarsKemmann]

@kiview

it's not something we explicitly productize.

Well, now I'm intrigued. 😁 How would I do that? So far, I thought that my only option would be to create a custom Dockerfile, deriving from docker/sandbox-templates:shell, do my own setup there (which, annoyingly, would duplicate the work I've done in defining devcontainers.json, rather than letting me reuse it), and then incorporate an agent CLI of my choice via the experimental Kits feature as you suggested.

This issue was really about suggesting that the Aspire team add documentation for sbx to the "non-local dev environment" section of their docs site, to help developers start off with a more secure configuration (especially given that Aspire-orchestrated codebases often involve accessing cloud resources from a local environment).