Introduction

Welcome to FactorySandbox, a remote Docker-compatible sandbox service for AI agents and automation. This documentation shows how to point the Docker CLI at FactorySandbox, authenticate with a client token, and run isolated workloads using normal Docker commands.

What is FactorySandbox?

FactorySandbox runs Docker workloads in isolated, ephemeral sandboxes outside your infrastructure. Agents can use images such as Alpine, Python, Node, Ubuntu, or your own Docker images, while your application keeps the same Docker CLI workflow it already understands.

Technical Overview

FactorySandbox terminates the Docker Engine API at the FactorySandbox endpoint. The service authenticates the request, translates supported Docker operations into sandbox lifecycle commands, and starts or manages containers on remote servers using the Kata Containers runtime for an additional isolation boundary.

The goal is Docker CLI compatibility wherever the Docker API maps cleanly to remote, isolated sandbox execution. Commands such as docker run, docker ps, docker logs, and docker rm should feel like normal Docker workflows while running away from your own hosts.

Key Features

• Docker CLI workflow - Use docker run, docker ps, and docker rm
• Secure isolation - Run untrusted workloads away from your application hosts
• Any base image - Start from the Docker image your agent or workflow expects
• Client token authentication - Authenticate Docker CLI requests with a bearer token
• Real-time logs - Observe sandbox stdout, stderr, status, and duration in the dashboard
• Concurrency-based plans - Choose a tier by maximum running sandboxes, not per-second billing

Basic setup

After creating a client token in the dashboard, export these variables in the terminal where Docker runs:

export DOCKER_HOST=tcp://docker.factorysandbox.ai:2377
export DOCKER_CUSTOM_HEADERS='Authorization=Bearer <your-api-token>'

docker run --rm alpine echo hello

Quick Links