Docker shipped a product this week with a feature it calls YOLO mode, and the marketing line is almost a dare: "No manual review, no permission prompts, no supervision required." Docker Sandboxes gives Claude Code, Copilot CLI, Codex, OpenCode, and Kiro each a dedicated microVM with only your project workspace mounted in, plus an outbound firewall and secret injection, so an agent can run unattended and the isolation is the safety net. The HN thread sits at 678 points, and a Docker engineer shows up in the comments to correct a common misread: this is not containers. Each session is a microVM with its own kernel on the native hypervisor (Hypervisor.framework, WHP, KVM), running on a VMM Docker wrote itself, not Firecracker.
I read that thread and watched the industry's answer to "how do I run an agent safely" settle into one shape: put the agent in a cage, then let it work at full speed. That is the right answer for a coding agent, which installs packages, edits configs, and executes arbitrary commands. My agent is not a coding agent. It is the e-commerce assistant from Parts 1 through 10, the same nine tools, same supervisor, same memory, and it never runs a command. Its cage is not a microVM. Its cage is the permission model around each of the nine tool calls, and this part is about building that cage. I am a Senior Software Engineer II at BS23 in Dhaka, and I have been building production AI agents with Spring Boot and Spring AI for over a year.
