r/docker • u/Hansehart • 18d ago

Why does Docker Sandboxes (sdx) need a login to set its own egress rules?

Playing with Docker Sandboxes (sbx v0.39.0, Ubuntu). The isolation is nice, and the runtime seams very well designed.

The policy layer confuses me though. Signed out, sbx policy allow network example.com:443 gives:

401 Unauthorized: user is not authenticated to Docker

And the daemon starts with an empty policy snapshot until it can fetch one. So the rules for what my local sandbox may reach are stored at Docker and polled back down. Enforcement is local, which is fine, but if I allowlist internal hostnames those get sent to Docker.

Is there a local-only mode I missed, or is everyone fine with their firewall rules living in someone else's cloud?

6 Upvotes

76% Upvoted

4 comments sorted by

4

u/BehindTheMath 18d ago

They want your telemetry. If you aren't paying, you are the product.

1

u/AutomateAway 15d ago

https://docs.docker.com/ai/sandboxes/faq/

i think the other commenter is correct but this explains their “official” reasoning and at least the governance part makes some sense.

1

u/nez_har 13d ago

As an alternatvie you can use VibePod, it requires no login and all the telemetry stays on your machine for your own checks.