Hacker News Reader

So what "sandboxing" does this add that is not already present in Docker, and how can users be any more assured that software cannot break out (which has happened at times with Docker).

Can a user blindly trust this sandbox, because that's how people will treat it based on the marketing. Sounds like it could be useful for far more than just AI though.

View on HN

> So what "sandboxing" does this add that is not already present in Docker

Docker Sandbox spawns a micro VM, not a standard container isolated by host kernel mechanisms (Linux namespaces etc.)

Does it come with the downsides of standard VMs? (Dedicated resources like memory and CPU cores, virtual disk images.)

Yes, though since it's a "micro" VM, it shouldn't take up nearly as many resources as a regular VM. Some hypervisors also implement memory ballooning to not take up memory that's not being used, but I'm not sure whether Docker Sandbox's hypervisor implements that.

Reply on news.ycombinator.com