The data suggests something is missing.
Docker's announcement for Cloud Sandboxes claims "sub-second cold start" for microVM-isolated AI agents. There is no independent benchmark. No published P50. No P99. No load-degradation curve. In isolation that gap means little. Here it matters, because the entire pitch leans on a comparison to machinery that has already been measured. AWS Firecracker publishes starts in the ~125ms band. E2B advertises ~150ms. "Sub-second" spans 100 milliseconds to 999 — a tenfold range. When a vendor chooses a vaguer word than its competitors' precise number, the vagueness is the finding. A performance claim without a tail latency is a marketing claim, not an engineering one. I have spent years pulling gas numbers and proving times out of ZK-rollup stacks, and the rule never breaks: the number you are not shown is the number that decides the unit economics.
Context: what Docker actually shipped
Docker's Cloud Sandboxes run AI agents inside self-developed microVMs — hardware-virtualized, each with an independent guest kernel — instead of shared-kernel containers. The choice is not novel. Firecracker proved this pattern at scale since 2018, and Intel VT-x / AMD-V have been universal silicon since the mid-2000s. What is novel is the packaging, in two parts.
First, a cross-platform VMM. Firecracker is Linux/KVM only. Docker built its own hypervisor abstraction to unify macOS, Windows, and Linux under one runtime — a direct answer to where developers actually work, not where cloud platforms prefer them to.
Second, Kits v3: a spec that packs runtime access policy — network egress, credentials, volumes, ports — into OCI images. The spec is Apache 2.0 and was submitted to CNCF. The service itself stays closed. This is the Red Hat pattern retold: open the standard, monetize the service. Competitors in the same lane include E2B, Modal, Cloudflare, AWS Bedrock AgentCore, and Vercel — but Docker enters with the largest developer distribution network of the group.
Tracing the silent logic where value meets code, the design choices are legible. The isolation is not the innovation. The permission model is.
Core: the three trade-offs nobody priced
One: microVM density is the hidden cost. A shared-kernel container carries process-level overhead. A microVM carries an independent guest kernel, VMM memory, and separate memory management. Firecracker squeezes that to a few megabytes per VM. That is still orders of magnitude above a container process. Docker has published no single-host concurrency number and no per-sandbox memory floor. Every microVM carries overhead. If one agent equals one microVM, the same physical machine runs fewer agents — and every concurrent agent costs more than the container equivalent. That is a unit-economics ceiling, and it is invisible in the launch copy.
I ran a comparable exercise in 2024, benchmarking proving time and gas cost across four ZK-rollup stacks. The bottleneck was never the headline throughput figure — it was the aggregation layer that aggregated the costs. The same structural trap sits here. Sub-second cold start says nothing about what a sustained agent fleet costs after the pre-warmed pool fills.
That pre-warmed pool is the second overlooked cost. To hit sub-second under load, you keep idle, paid capacity running. Agents that idle — waiting on human approval, waiting on an external API — consume resources that do not shrink. "Kill and restart on demand" sounds efficient until you weigh the idle pool that makes it fast. Serverless cold start is cheap to advertise and expensive to hold.
Two: the permission model is the genuinely good part. Kits v3 borrows from the Android permission framework and the principle of least privilege, with one design decision that matters more than the rest: when the host cannot satisfy a required request, the sandbox refuses to start rather than launching with reduced privileges. Silent degradation is a classic security anti-pattern — the system appears to run while quietly dropping the control that protected you. Docker's default-deny semantics close that door. I do not trust the doc; I trust the trace, and the trace here shows the right call.
Three: the credential proxy is the real differentiation — until it isn't. Docker injects authentication headers only on hostname match; the agent never touches the raw secret. This cuts the classic AI agent failure — private data plus untrusted input plus outbound network equals exfiltration — at the exfiltration link. I audited MakerDAO's CDP mechanics in 2020 and found the critical edge case lived not in the collateral logic but in the price-feed oracle latency. The proxy layer here sits on the identical critical path: every sandbox's outbound traffic routes through it. That makes it both the strongest control and a new single point of contention. Its latency penalty is published nowhere.
And because agents execute arbitrary Linux binaries — pip install, npm build, native toolchains — microVM beats both gVisor (incomplete syscall coverage) and WASM (cannot run unported natives). Compatibility, not density or speed, is why microVM wins. The report never states this trade-off. That omission is the analysis.
Contrarian: the overreach
The launch copy claims that even a compromised agent "cannot steal credentials or reach unauthorized endpoints." That holds only if the authorized scope is itself safe. If the agent is legitimately permitted to call a GitHub API, an injected agent can still open pull requests, push to private repos, or write to issues. The credential proxy protects the key. It does not protect the authorized action. The blast radius moved; it did not disappear. In crypto terms, this is the difference between guarding a private key and guarding what that key is allowed to sign.
Three more silences. MCP integration is listed as a pure feature. MCP servers are a validated attack surface — tool poisoning, rug pulls, description injection, cross-server shadowing. Zero discussion. Permission fatigue is unaddressed: a strict default-deny model will train users to rubber-stamp prompts, quietly dissolving the security it was built to enforce. And Docker is, almost certainly, a cloud on a cloud — reselling bare-metal or nested-virtualization instances from AWS or GCP and layering its VMM on top. That makes the largest suppliers also the most likely competitors.
The unexpected gain is buried. Because microVMs hold no persistent state and are killed and restarted, an attacker's dwell time and lateral-movement window collapse. Docker never sells this as a security feature. It should.
Takeaway
The isolation is commodity. The standard is the bet. Docker cannot outspend AWS or Cloudflare on capacity, so it traded a standard for survival space — and the win condition is not the microVM. It is whether Kits receives a second independent implementation within 12 to 18 months, or whether it degrades into a single-vendor spec. Watch the CNCF decision, the first published density benchmark, and the first pricing sheet. Dissecting the corpse of a failed standard is easy; predicting which one lives is the only question worth answering.