Can someone more versed in Docker explain to me how this is different than building my own docker container from a Dockerfile for using Pi agent harness? That's what I do currently. I use Docker Desktop in windows as the backend for that.

▲ Hugsun 37 minutes ago | parent | next [-]

Docker containers use Linux kernel features to create an isolated environment, running on the same machine as docker is. This creates a virtual machine, with its own kernel, and runs the container in there. This gives stronger isolation and security guarantees.

▲ eloisius 31 minutes ago | parent | next [-]

I have the same question as GP. Your answer helps a little but not really. I might be naive, but I was under the impression that malicious code escaping a docker image and running amok on my host system was not something I should be too worried about. Especially if I run docker in rootless mode. Is that wrong?

For clarity I’m actually using podman, not Docker.

▲

angry_octet 18 minutes ago | parent [-]

Oh no, you should definitely be worried about that. Podman might make it harder to escalate to host root, or manipulate other containers, but it is still vulnerable.

Now I'm curious to know how hardened the Docket Sandbox orchestration interface is. I guess we can assume they have run Mythos against it for a few weeks maybe? It's unclear.

	▲	eloisius 9 minutes ago \| parent [-]
		Unsettling. I mean, is there any reasonable way to develop software in 2026? I've already sworn off ever installing npm directly on my host. Containerizing everything is laborious enough, but running a separate VM for everything?

▲ sureglymop 17 minutes ago | parent | prev [-]

That depends on the runtime though. For example, libkrun lets you do this:

    docker run --runtime krun hello-world

That starts/runs the OCI in a qemu microvm.

▲ angry_octet 23 minutes ago | parent | prev [-]

It's a VM.