Set up Sandboxed mode

01 · Boundary

What Sandboxed protects

The agent works inside an isolated Docker sandbox instead of running with general access to your Mac. This gives it a private filesystem, network, and Docker environment.

The agent and its provider still need the repository content used for the run. Services allowed by your Docker network policy can still receive requests. Sandboxing does not guarantee that generated code is correct or ready to deploy.

02 · Requirements

Check the requirements

• A Mac with Apple silicon running macOS 14 or later.
• A compatible sbx command line tool.

You do not need Docker Desktop or Docker Engine.

Install Docker Sandboxes using Docker's current guide

03 · Docker account

Sign in to Docker Sandboxes

Run this command in Terminal. It opens Docker's own browser authentication flow.

sbx login

Docker Sandboxes authentication is separate. Signing in to Docker Desktop does not authenticate sbx.

04 · Daemon

Start Docker Sandboxes when needed

If GoalCoder says Docker Sandboxes is not running, start the daemon in the background:

sbx daemon start --detach

GoalCoder does not start or stop this daemon.

Read Docker's daemon command reference

05 · Network

Choose the global network policy

Docker requires you to choose a global policy. It applies to all Docker sandboxes on this Mac. GoalCoder recommends Balanced as a practical starting point, but the decision is yours.

sbx policy init balanced

GoalCoder does not initialize, reset, or change this policy.

Review Docker's network policy choices

06 · Codex

Set up Codex authentication

Start the OpenAI OAuth flow from Terminal:

sbx secret set openai --oauth

Docker owns this flow and its credential storage. GoalCoder does not receive your OpenAI credential.

Read Docker's Codex authentication guide

07 · Claude Code

Set up a Claude subscription

Open a Claude sandbox, then enter this command inside Claude Code:

/login

This signs Claude Code in with your Claude subscription. Docker Sandboxes authentication remains separate.

Read Docker's Claude Code authentication guide

08 · Initial setup

Allow time for initial setup

Initial setup can take several minutes while Docker downloads the sandbox environment. GoalCoder does not promise a completion time or show a progress percentage.

Later attempts normally use files that Docker has already cached.

09 · Recovery

Diagnose the blocker, then retry

Start with Docker's diagnostic command:

sbx diagnose

If an agent cannot install a package or reach a service, inspect the network policy log:

sbx policy log

1. Find the blocked destination.
2. Check that it belongs to the work and that you trust it.
3. Use Docker's policy guidance to allow only the destination you need.
4. Retry the action that failed.

If a Docker organization manages the policy, a local allow rule may not take effect. Ask the organization administrator to review the policy.

Continue with Docker's troubleshooting guide