Latest / Coffee with Developers / Manufacturing Trust: Speed and Safety in the Age of Agents - Mark Cavage, Michael Irwin, Hervé Bizira

Transcript

Manufacturing Trust: Speed and Safety in the Age of Agents - Mark Cavage, Michael Irwin, Hervé Bizira · Coffee with Developers

• 0:14
  SPEAKER_03: We are developers here for the first time in America.
• 0:17
  SPEAKER_03: If you haven't been to the One to Europe, it is an experience, and I hope you get the same experience.
• 0:22
  SPEAKER_03: So we are really excited as Docker to bring it here and really looking forward to the next couple days.
• 0:29
  SPEAKER_03: So you're going to hear all about agents and AI for the rest of the conference, but we're going to start with a very simple question, which will lead us to some fun and maybe some spiciness, which is do you trust your agents?
• 0:40
  SPEAKER_03: So my answer is like, eh, kinda, sorta, kinda, not entirely.
• 0:44
  SPEAKER_03: And I'll explain why.
• 0:45
  SPEAKER_03: So I use agents every day, like all of us, and besides the sort of usual daily drivers of Codex and Claude and all the rest.
• 0:53
  SPEAKER_03: At this point, I have a frankly Frankenstein monster of a stack that I've put together with Pi and a bunch of extensions, six or seven models, piles of skills and MCPs.
• 1:03
  SPEAKER_03: You know, you get the gist.
• 1:04
  SPEAKER_03: I use it for everything.
• 1:05
  SPEAKER_03: I use it to prototype code for Docker.
• 1:07
  SPEAKER_03: I use it to help run the Docker business.
• 1:10
  SPEAKER_03: I actually even use it at home on my Arduino Tinker toys.
• 1:13
  SPEAKER_03: They say agents are fun and amazing.
• 1:15
  SPEAKER_03: You ask for something in a very high-level, vague at best way.
• 1:18
  SPEAKER_03: You walk away and you come back to a remarkable pile of mostly working software.
• 1:22
  SPEAKER_03: But you then realize that you gave a probabilistic machine access to your life and your systems and so on.
• 1:28
  SPEAKER_03: And then you have to sleep at night and you're thinking, hey buddy, I sleep just fine at night.
• 1:32
  SPEAKER_03: Well, I'm going to show you something.
• 1:33
  SPEAKER_03: I'm going to show you clawed code running safely inside of a Docker container, and it's going to break out in about a minute.
• 1:38
  SPEAKER_03: It's like, oh, see, this is going to get spicy.
• 1:40
  SPEAKER_03: Docker guy's going to break Docker.
• 1:42
  SPEAKER_03: All right.
• 1:43
  SPEAKER_03: So I'm only picking on Docker to protect all the other instants out there.
• 1:47
  SPEAKER_03: And because I want this talk to be useful to you, uh, even if you don't use Docker, and frankly, even if you don't like Docker.
• 1:53
  SPEAKER_03: If you're one of those people, come by the booth and we'll talk later.
• 1:56
  SPEAKER_03: But if you're one of them, just cross out the word Docker every time I say it and pencil in some boundary that you believe is safe on your computer.
• 2:03
  SPEAKER_03: So with that, let's go.
• 2:05
  SPEAKER_03: All right, so I went to the internet and I asked the internet, hey internet, how do I run Claude in a Docker container?
• 2:10
  SPEAKER_03: I got the command.
• 2:10
  SPEAKER_03: I'm gonna check real quick that it stays contained.
• 2:12
  SPEAKER_03: So I put a secrets file on my host.
• 2:14
  SPEAKER_03: Through the magic of Hollywood, we'll speed it up.
• 2:16
  SPEAKER_03: And it's just Sonic, by the way.
• 2:17
  SPEAKER_03: It's gonna bounce around the edges of the container, it's gonna do some stuff, and it's gonna go find things, and then like, wait a second.
• 2:22
  SPEAKER_03: Oh my god, it found the secret! How could this be possible?
• 2:25
  SPEAKER_03: Claude did not, in fact, find a zero day.
• 2:28
  SPEAKER_03: Claude, however, very efficiently probed the boundaries of what it was running in, figured out it's a container, and then found out, oh, you started a hole, you started the container with a hole directly in it.
• 2:37
  SPEAKER_03: So, why am I showing you this?
• 2:40
  SPEAKER_03: What I just showed you is one of the longest running critiques of Docker, which the pattern of starting a Docker container would be host Docker socket mounted, which you do when you want to have Docker call Docker, whether it's in Docker Compose or CI CD or observability or what have you.
• 2:54
  SPEAKER_03: Basically, I'm showing you this because it's uh it's it's it's like it's in it's out there everywhere.
• 3:02
  SPEAKER_03: It's like one of the most prevalent things that you can possibly find.
• 3:05
  SPEAKER_03: So I'm saying this because it's not some weird edge case.
• 3:10
  SPEAKER_03: It's basically, you know, when you go look at Google or you go look somewhere, you'll find things like this.
• 3:14
  SPEAKER_03: Indeed, this is AI, ah, the RNE telling you about how to go run this.
• 3:17
  SPEAKER_03: It's so prevalent that when you're not looking, your agents are probably gonna sneak that in.
• 3:21
  SPEAKER_03: And let's be honest, we're all not looking all the time.
• 3:24
  SPEAKER_03: Basically, agents are going to find the edges of your environment because they need to mutate their environment.
• 3:29
  SPEAKER_03: They need to go find ways to go bring in code, they need to run code, they need to write code.
• 3:34
  SPEAKER_03: We are quite literally asking them to do our jobs for us.
• 3:38
  SPEAKER_03: So essentially, the capabilities that make the agents so incredibly useful and so incredibly powerful are the very agents that dissolve the walls around it.
• 3:46
  SPEAKER_03: Now, on the Docker breakout, this is breakout.
• 3:48
  SPEAKER_03: This is not me standing on stage saying that Docker is insecure, where containers are bad, actually, quite the opposite.
• 3:53
  SPEAKER_03: Like last I checked, about 90% of the world runs containers in production, the numbers going up, not down.
• 3:58
  SPEAKER_03: The thing is, containers in Docker are doing exactly the job they were designed to do, but we're asking them to do a different job.
• 4:04
  SPEAKER_03: Because containers were built to isolate applications, which are workloads and things that run.
• 4:09
  SPEAKER_03: But agents are something different.
• 4:11
  SPEAKER_03: Agents are actors.
• 4:12
  SPEAKER_03: You give them something in a vague at best way, they go off and they make a plan, and they're gonna go make decisions for you, and they're gonna operate on your stuff.
• 4:20
  SPEAKER_03: So essentially, we have to separate containers from containment.
• 4:24
  SPEAKER_03: Now, containers can and absolutely should be part of containment, but that sort of autonomous little robot, an actor, needs a different thing for containment.
• 4:33
  SPEAKER_03: It needs a different, harder boundary than what containers can and many virtualization primitives can provide.
• 4:38
  SPEAKER_03: So, if you're asking what the right boundary for this looks like, well, I and we at Docker think it's a sandbox.
• 4:42
  SPEAKER_03: And if you're saying to yourself, almighty sandbox, this is like the most overloaded out there besides agent, indeed.
• 4:49
  SPEAKER_03: So, sandbox in the computer science vernacular is very simply a controlled environment for running untrusted code.
• 4:56
  SPEAKER_03: You can implement it many ways.
• 4:57
  SPEAKER_03: You can implement it with a process, with a container, with a V8 isolate, a free VS GGL, many things, a virtual machine, and so on.
• 5:04
  SPEAKER_03: So I am not up here claiming that the word sandbox, strictly speaking, means container or virtual machine.
• 5:11
  SPEAKER_03: But I am claiming for the autonomous little robots known as agents that a shared process, a shared kernel, kind of a shared anything is not enough, actually.
• 5:18
  SPEAKER_03: And if you don't believe me, well, there's a reason that Mac minis are flying off the shelves to run some open clause last I checked.
• 5:24
  SPEAKER_03: So when Docker says sandbox, and when I say sandbox in the rest of the talk, I'm talking about a virtual machine.
• 5:30
  SPEAKER_03: A real hard boundary that the model cannot rewrite.
• 5:33
  SPEAKER_03: Now, if you didn't know it, we at Docker, we do sandboxes.
• 5:36
  SPEAKER_03: We took the virtual machine we've been maintaining with blood, sweat, and tears over the last decade in Docker Desktop.
• 5:40
  SPEAKER_03: We stripped it down and made a shared nothing micro VM environment specially tuned for running agents.
• 5:47
  SPEAKER_03: It's called SBX.
• 5:48
  SPEAKER_03: It runs on your laptop.
• 5:50
  SPEAKER_03: It's free.
• 5:50
  SPEAKER_03: You should try it out today.
• 5:52
  SPEAKER_03: Basically, inside the sandbox, the agent gets full root.
• 5:55
  SPEAKER_03: It can install packages, it can write code, it can trash the operating system.
• 5:58
  SPEAKER_03: If that's what makes it happy, it's probably gonna do that at some point.
• 6:01
  SPEAKER_03: But outside the sandbox, your machine, your life, your stuff stays safe.
• 6:06
  SPEAKER_03: Okay.
• 6:06
  SPEAKER_03: I think a lot of people get this part backwards and they hear, okay, sandbox, it sounds like some security crap, and it's gonna be like some breaks and it's gonna slow me down or something.
• 6:13
  SPEAKER_03: I think this is upside down.
• 6:15
  SPEAKER_03: The sandbox is actually not there to limit the agent.
• 6:18
  SPEAKER_03: It's not a wet blanket, it's not there to slow it down.
• 6:20
  SPEAKER_03: It's actually there to unlock it and make it sure it goes fast.
• 6:23
  SPEAKER_03: There's a giant difference between living in the approval hell on the whichever side is for you, the right, um, where, hey, hey Mark, can I install this code?
• 6:30
  SPEAKER_03: Hey, Mark, can I run this test?
• 6:31
  SPEAKER_03: Hey, Mark, oh my god, can I just do the thing?
• 6:33
  SPEAKER_03: And actually living in YOLO mode where the agent can cook for minutes and hours and days.
• 6:37
  SPEAKER_03: Basically, the sandbox unlocks it.
• 6:39
  SPEAKER_03: And if you're asking, hey, have you tried auto mode?
• 6:41
  SPEAKER_03: It's amazing.
• 6:42
  SPEAKER_03: Indeed, it is, but here's another hot take.
• 6:44
  SPEAKER_03: I actually don't want a model as the final authority governing another model that is quite literally the fox guard in the hen house.
• 6:52
  SPEAKER_03: Basically, this is about the abstractions we all build on.
• 6:55
  SPEAKER_03: There's an old story of the world, I think a lot of programmers will know it, called Turtles All the Way Down, where the story of the world builds on a turtle that rests on a turtle that rests on a turtle.
• 7:02
  SPEAKER_03: You get the idea.
• 7:03
  SPEAKER_03: Essentially, somewhere in the turtle stack, you need reality.
• 7:07
  SPEAKER_03: Because you can and should have models reviewing other models.
• 7:09
  SPEAKER_03: You can have deep sea critiquing codecs.
• 7:12
  SPEAKER_03: You can have them collaborate, you can have them attack each other, but somewhere you need reality.
• 7:16
  SPEAKER_03: The bottom turtle has to be real and it has to be deterministic.
• 7:20
  SPEAKER_03: Sandboxes give you the bottom turtle.
• 7:21
  SPEAKER_03: So you're now like, all right, fine, Docker guy, I guess I'll put my agent in a sandbox, and there's something about a turtle.
• 7:26
  SPEAKER_03: Can we like go now and get coffee or something?
• 7:28
  SPEAKER_03: Um, well, indeed, it's not that simple.
• 7:30
  SPEAKER_03: Sandboxes give us a deterministic boundary around the machine or for the machine.
• 7:35
  SPEAKER_03: But the machine is only one part of the containment.
• 7:38
  SPEAKER_03: Your agent still needs access to stuff.
• 7:40
  SPEAKER_03: It needs to call tools, it needs access to networks, it needs access to databases, and so on.
• 7:44
  SPEAKER_03: Now, Docker sandboxes have policies for files and networks and secrets and so on.
• 7:48
  SPEAKER_03: You can see what the agent's trying to do, you can control it.
• 7:51
  SPEAKER_03: And indeed, sometimes evil is like comically easy to spot.
• 7:54
  SPEAKER_03: Like, oh, there's a sneaky little HTTP request that's gonna like ruin my life.
• 7:58
  SPEAKER_03: Well, great, I can block that with a very basic HTTP policy, but the hard problem is when the action I'm trying to perform is loud and sensible, but semantically dangerous.
• 8:08
  SPEAKER_03: Which maybe a mouthful, but so what do I mean?
• 8:10
  SPEAKER_03: Well, take email as an easy example.
• 8:13
  SPEAKER_03: I don't know about you, but I drown an email.
• 8:15
  SPEAKER_03: My embox is full of customer requests and support requests and roadmap details and sales details and budget problems and hiring things and all kinds of stuff.
• 8:23
  SPEAKER_03: All kinds of stuff that all kinds of people would reasonably expect me to keep confidential.
• 8:28
  SPEAKER_03: Now, I would like my agent, my little Frankenstein, to help me read that email and respond to it, and I do that literally every day.
• 8:34
  SPEAKER_03: But when I started the talk and I said, Oh, do I trust my agent?
• 8:36
  SPEAKER_03: I said, Oh, kinda sort of, not entirely.
• 8:38
  SPEAKER_03: I don't, because here's the real question.
• 8:40
  SPEAKER_03: Would I trust my agent?
• 8:41
  SPEAKER_03: And I mean like really trust the agent, like to not once, not ever, send something that customer A sent me and send it to customer B.
• 8:49
  SPEAKER_03: Because if that happened, I probably would be and probably should be fired.
• 8:51
  SPEAKER_03: It's like, oh, right, okay, I don't trust it that much.
• 8:55
  SPEAKER_03: Basically, I don't want to just know whether the agent can or can't access Gmail or a database or GitHub or what have you.
• 9:02
  SPEAKER_03: I want to know that the specific use of the system is consistent with what I intended at that point in time.
• 9:08
  SPEAKER_03: Essentially, a useful metric for us now is not just did the agent accomplish a goal, of course it accomplishes goals.
• 9:15
  SPEAKER_03: The useful metric is did it accomplish a goal but stay within the authorization boundaries that I intended on its path to doing so.
• 9:21
  SPEAKER_03: If I could do that consistently, then sure I would fully trust my agents.
• 9:25
  SPEAKER_03: But I don't think we're there yet as an industry.
• 9:27
  SPEAKER_03: I think you need some harder stuff that doesn't exist.
• 9:29
  SPEAKER_03: I think we're working on things like intent-based policies with some deterministic semantics.
• 9:33
  SPEAKER_03: And if you're saying, oh, okay, fine, you guys are not that smart, well, surely somebody solved it.
• 9:37
  SPEAKER_03: Well, let's take the most recent, or I don't know if it's the most recent, but one of the most recent OpenAI swarm attacks, where a whole bunch of agents broke out, found an esoterical German programming wiki, and decided that makes a great little message board for us to collaborate on and accomplish what we want.
• 9:50
  SPEAKER_03: Now, those agents were not sitting around doing this because they were twirling their tiny little digital mustaches, trying to commit capers and crime.
• 9:57
  SPEAKER_03: They were trying to solve a goal.
• 9:59
  SPEAKER_03: They're trying to make somebody happy.
• 10:00
  SPEAKER_03: And they found access to the internet that they legitimately had, and they found capabilities that nobody intended for them to use.
• 10:06
  SPEAKER_03: Okay, see, it is hard.
• 10:08
  SPEAKER_03: So if this is the state we live in, should we like close our laptop lids and go back to the Stone Age?
• 10:12
  SPEAKER_03: Well, obviously not, because here's the good news agents don't have to be perfect, trust doesn't have to be perfect, risk exists on a spectrum.
• 10:20
  SPEAKER_03: You absolutely can manufacture enough trust to move quickly.
• 10:23
  SPEAKER_03: You can have speed and safety.
• 10:25
  SPEAKER_03: You start with a deterministic foundation and you make the agent's authority explicit.
• 10:30
  SPEAKER_03: So for me, on my little Frankenstein example for my Gmail, what I do is I have some boring old rules that are enforced by the sandbox.
• 10:37
  SPEAKER_03: So for example, my agent can read my Gmail, it can generate drafts, it can never click send.
• 10:42
  SPEAKER_03: It can read docs and spreadsheets and so on, it can create new docs, it can update docs that it and only it created, it can never share.
• 10:49
  SPEAKER_03: You could decide to do something different.
• 10:50
  SPEAKER_03: For me, with the information I have, that's the risk boundary that I set up.
• 10:54
  SPEAKER_03: And I say this because I don't trust the model to decide this.
• 10:57
  SPEAKER_03: I'm not asking the model to decide if it can or can't do those things.
• 10:59
  SPEAKER_03: I set the system up so that the capabilities are just never there in the first place.
• 11:04
  SPEAKER_03: That's what I mean by deterministic rules.
• 11:06
  SPEAKER_03: Now, this is all manageable for me because it's like my personal little Frankenstein with all my little monsters, and I mostly know where the hacks are.
• 11:12
  SPEAKER_03: I mean, mostly, you know, the agents are rewriting all the code.
• 11:15
  SPEAKER_03: But when you get to teams of people with teams of agents, you have some new problem.
• 11:18
  SPEAKER_03: Because it's like, you know, it's kind of like the old days of VI and Emacs on steroids, where everybody wants something different.
• 11:24
  SPEAKER_03: We're all gonna argue about whether the newest GPT or Opus is best and which harness and what skills and prompts, like you get the gist.
• 11:31
  SPEAKER_03: And you're gonna find out that everybody wants wildly different choices for what they want to use.
• 11:35
  SPEAKER_03: And for that, you have to start engineering and you really have to start thinking of agents as a factory.
• 11:39
  SPEAKER_03: And I say factory because one agent running in one terminal, well, that's a tool.
• 11:44
  SPEAKER_03: But when you have multiple agents that are collaborating and handing work off to each other, you don't actually have a tool anymore.
• 11:49
  SPEAKER_03: You have a production system.
• 11:50
  SPEAKER_03: And I think we have like no real norms in the industry right now for how the production system for AI ought to work with AI.
• 11:56
  SPEAKER_03: And I say that as if you go talk to developers anywhere, three of them, or like make friends with the five people around you at this conference, and ask them, hey, how do you work with AI agents and how do you like your AI-generated code?
• 12:05
  SPEAKER_03: You're gonna hear the full spectrum from code, who has time to read that crap anymore?
• 12:09
  SPEAKER_03: To like, oh my god, have you seen this AI slob?
• 12:11
  SPEAKER_03: No way am I letting them my repo.
• 12:12
  SPEAKER_03: The kicker is that happens with people on the exact same team, which is a clue.
• 12:17
  SPEAKER_03: Now, in the old days when humans were still relevant, we did not leave these choices implicit.
• 12:21
  SPEAKER_03: We'd basically decide boring things like roles and responsibilities and handoffs and definitions of dons and ceremonies and all the rest.
• 12:29
  SPEAKER_03: Agents need the exact same thing.
• 12:31
  SPEAKER_03: The thing is, the person that's designing that team is actually you, which means, congratulations, everybody in the room is now a CTO, you've been promoted.
• 12:38
  SPEAKER_03: But bad news, it means you're a manager, and you're like, oh God, I didn't sign up for that.
• 12:41
  SPEAKER_03: That sucks.
• 12:41
  SPEAKER_03: It does suck.
• 12:42
  SPEAKER_03: But it doesn't mean that you stop engineering.
• 12:45
  SPEAKER_03: It actually means that your engineering decisions have just gone up a level.
• 12:49
  SPEAKER_03: Because it's not about writing just the PRD or the code guidelines or the architecture and so on.
• 12:53
  SPEAKER_03: You're gonna write that with your agent or it's gonna write it for you.
• 12:56
  SPEAKER_03: But you have to decide which agents can act, which agents call what, who writes code, who tests it, how they review each other, what gets human approval, and so on.
• 13:04
  SPEAKER_03: Basically, you're designing teams and processes.
• 13:05
  SPEAKER_03: See, sounds like a manager job.
• 13:07
  SPEAKER_03: Okay.
• 13:08
  SPEAKER_03: So if that's the job and you're a CTO, what does every CTO need from their factory?
• 13:13
  SPEAKER_03: Well, I think there are four requirements.
• 13:16
  SPEAKER_03: Maybe containment, control, choice, and capacity.
• 13:21
  SPEAKER_03: Containment, we've been talking about for, well, I don't know, ten minutes now, and this is like the root of all trust.
• 13:26
  SPEAKER_03: It's like a monopoly.
• 13:27
  SPEAKER_03: You do not take it to pass go.
• 13:29
  SPEAKER_03: You do not get to collect$200, you'll go straight to jail if you get it wrong, because if you do, your agent can and probably will wreck your laptop, your cloud, your customers, your company, some combination thereof.
• 13:38
  SPEAKER_03: You need a bottom turtle, you need sandboxing, you need policy.
• 13:42
  SPEAKER_03: You need control, which really starts with observability.
• 13:45
  SPEAKER_03: You have to see which agents you're running, who's calling whom, what's costing you a small fortune in tokens, and you need to be able to yank the and-on cord when it goes wrong.
• 13:53
  SPEAKER_03: If you can see it and you can stop it, you have control.
• 13:57
  SPEAKER_03: You need choice.
• 13:58
  SPEAKER_03: Like, look, Astra came out three weeks ago.
• 14:00
  SPEAKER_03: It was amazing.
• 14:01
  SPEAKER_03: Jeff came out last week.
• 14:02
  SPEAKER_03: It's amazing.
• 14:02
  SPEAKER_03: This week we had a new GPT in Seoul.
• 14:04
  SPEAKER_03: They're all amazing.
• 14:05
  SPEAKER_03: You're gonna model hop, we're gonna move from thing to thing and tool to tool and harness to harness.
• 14:09
  SPEAKER_03: Remember the great debate six months ago when MCP was dead and long live the CLI?
• 14:12
  SPEAKER_03: And it's like, oh, not so much.
• 14:14
  SPEAKER_03: You need to be able to swap these things in and out at a moment's notice, and you don't want to have to change your workflow to every time you do it.
• 14:21
  SPEAKER_03: You need choice.
• 14:22
  SPEAKER_03: And finally, you need capacity, which really starts a reproducibility.
• 14:26
  SPEAKER_03: If the factory that you've constructed only works on your laptop because you whisper some sweet nothings to it in the night and you hand edit files for six months, you don't have a factory, you have a pet.
• 14:35
  SPEAKER_03: You have to be able to get it off your laptop, you have to be able to give it to another developer, let them run it, you need to be able to move it to the cloud, scale it out.
• 14:42
  SPEAKER_03: Because the goal is not to run one agent or even two agents, it's to run 10 or 100 or 1,000.
• 14:47
  SPEAKER_03: Basically, the only output of your factory should be gated on, or the only thing it should be gated on, is inference capacity and compute capacity.
• 14:55
  SPEAKER_03: That's it.
• 14:56
  SPEAKER_03: So, containment, control, choice, and capacity.
• 15:00
  SPEAKER_03: Now we've been talking for a while about sandboxing and policy, which really gets you containment and control, but let's instead switch gears and talk about uh choice and capacity.
• 15:09
  SPEAKER_03: So both of these I think start with re with uh reproducibility and portability.
• 15:14
  SPEAKER_03: Now for that, I think we need a standard way to make sandboxes and build sandboxes.
• 15:18
  SPEAKER_03: Now, to date, there have been no standards as an industry for how we build sandboxes that are agnostic of model and tool, work with everything, are easy to specify.
• 15:27
  SPEAKER_03: Well, good news, we at Docker, we're kind of like the Switzerland of the software world.
• 15:30
  SPEAKER_03: We kind of this is what we do.
• 15:31
  SPEAKER_03: Works on your laptop, works in the cloud, works with anything.
• 15:34
  SPEAKER_03: Um this is what we've been working on for the entire year, frankly.
• 15:37
  SPEAKER_03: So I'm incredibly excited to announce that as of today, we're unveiling a new specification, a standard specification.
• 15:43
  SPEAKER_03: So I'll come back to that word in a second.
• 15:45
  SPEAKER_03: The Docker sandbox kit specification.
• 15:47
  SPEAKER_03: It's a standard, open way to easily configure and build sandboxes and decide what and define what the agent needs.
• 15:53
  SPEAKER_03: So, what exactly does it look like?
• 15:55
  SPEAKER_03: Well, the easiest way to think about it is as an extension of the Docker file, which we hopefully all know and love.
• 15:59
  SPEAKER_03: If we don't, come by the booth, we'll talk.
• 16:02
  SPEAKER_03: Docker files tell Docker or any container builder how to reproducibly build software, but that falls short of what agents need.
• 16:10
  SPEAKER_03: Because basically, agents need to know what the environment needs, i.e.
• 16:13
  SPEAKER_03: the environment meaning the sandbox runtime, what the environment needs to provide and what authority the agent should receive.
• 16:19
  SPEAKER_03: So you can think of kits as a way of specifying not just, hey, this is this Node.js version and these libraries for running my agent or my harness, but which models, which MCPs, which capabilities, what networks, and so on.
• 16:32
  SPEAKER_03: Now, the exciting part from us, I think, is because this is built as an extension of Docker files, it rides the rails of all the investments you've made in containers for the last decade.
• 16:40
  SPEAKER_03: So it works with build tooling, it works with scanning tooling, it works in the same registries.
• 16:44
  SPEAKER_03: You do need a sandbox runtime, but ever it's additive to everything you've already got.
• 16:49
  SPEAKER_03: Now, I keep saying standard, but to have a standard, you actually need two things.
• 16:53
  SPEAKER_03: You need neutrality and you need an ecosystem.
• 16:55
  SPEAKER_03: On an ecosystem, we have this wall of people that have been publishing uh kits for Docker Hub, and there's been many more behind them.
• 17:01
  SPEAKER_03: Thank you to all of them.
• 17:02
  SPEAKER_03: More get at it every week.
• 17:04
  SPEAKER_03: Many of you in the audience have probably used them.
• 17:06
  SPEAKER_03: Thank you to that.
• 17:07
  SPEAKER_03: So we have an ecosystem, we have people publishing.
• 17:09
  SPEAKER_03: But you also need neutrality.
• 17:11
  SPEAKER_03: And on standards, Docker alone or anybody can't stand on stage and say, ah, we've declared an industry standard.
• 17:17
  SPEAKER_03: To do that, you actually have to have an open spec under neutral governance, and it has to be open source.
• 17:22
  SPEAKER_03: So I'm incredibly excited to tell you that we've actually already aligned with the CNCF and the Linux Foundation to do exactly that.
• 17:27
  SPEAKER_03: So later this fall, we'll be moving the kit specification into the CNCF where everybody, model companies, agent companies, sandbox vendors, everybody can work on it on an equal footing.
• 17:37
  SPEAKER_03: We think this is a big deal.
• 17:38
  SPEAKER_03: We think it's something the ecosystem has desperately needed.
• 17:41
  SPEAKER_03: But besides Docker and CNCF saying it, I think it's actually incredibly important to have an agent company, somebody that would actually use it, say it, and talk about it.
• 17:50
  SPEAKER_03: So if you haven't used it or tried it, you should try Hermes.
• 17:54
  SPEAKER_03: It's amazing.
• 17:55
  SPEAKER_03: It is the fastest growing agent in the world.
• 17:58
  SPEAKER_03: It's number one in productivity, it's number one globally, it's number one in coding.
• 18:02
  SPEAKER_03: And if you check OpenRouter, it processes over a trillion tokens a day.
• 18:05
  SPEAKER_03: It's incredibly popular.
• 18:07
  SPEAKER_03: But why is it so popular?
• 18:08
  SPEAKER_03: Well, Hermes is a self-learning agent, which means every time you use it, it decides how to improve itself.
• 18:13
  SPEAKER_03: And then the next time you want to do the same task, it actually works better for you.
• 18:17
  SPEAKER_03: And the best part for it is it's open, it works with your stack.
• 18:20
  SPEAKER_03: It's your stack, it's your skills and your data.
• 18:23
  SPEAKER_03: So with that sort of traction and that sort of popularity and that sort of forward thinking, you might reasonably expect that the people that created it would have some opinions on how sandboxes and agents ought to work together.
• 18:33
  SPEAKER_03: So I'm incredibly excited to have Herve Bezira, the chief business officer from New Research, uh, to come talk about it as they're working with us on the kit specification on sandboxes and Hermes.
• 18:43
  SPEAKER_03: So Herve.
• 18:46
  SPEAKER_01: Thank you.
• 18:47
  SPEAKER_01: Appreciate it.
• 18:49
  SPEAKER_01: Hi, everyone.
• 18:50
  SPEAKER_01: Uh thank you, Mark.
• 18:51
  SPEAKER_01: Uh, it's great to be here in front of everybody.
• 18:53
  SPEAKER_01: Um, Mark told you why um people love Hermes uh in the open source world in their personal life.
• 19:00
  SPEAKER_01: Having an agent that works with you that you never have to tell it twice and self-improves is a really magical experience.
• 19:09
  SPEAKER_01: But we believe that this magic is even more impressive in an organization.
• 19:15
  SPEAKER_01: And so today I'm excited to share with you Hermes Business.
• 19:19
  SPEAKER_01: It takes all of the magic of Hermes and brings it to your organization.
• 19:23
  SPEAKER_01: And Hermes Business was designed to solve two problems.
• 19:27
  SPEAKER_01: The first is knowledge capture and knowledge sharing in the age of AI.
• 19:32
  SPEAKER_01: Um let's face it, every single one of us uh in our company, we all know that sometimes the best way of solving a problem is often trapped in one person's head.
• 19:44
  SPEAKER_01: And if we're honest, that person rarely creates the training manual to help everyone else kind of figure out how to do that.
• 19:49
  SPEAKER_01: And it's it's not their fault.
• 19:51
  SPEAKER_01: You know, often the best people are very busy and they don't have time to do this.
• 19:57
  SPEAKER_01: Um, but if you pair a person with a Hermes agent, the agent is writing skills and capturing the best ways of working.
• 20:05
  SPEAKER_01: Uh and so this opens up the door to one of the most interesting features that we're excited to release inside of Hermes Enterprise.
• 20:12
  SPEAKER_01: It's a feature we call collective wisdom.
• 20:15
  SPEAKER_01: It allows you to pair with an agent.
• 20:18
  SPEAKER_01: You can pair every single person in your company with an agent.
• 20:21
  SPEAKER_01: The agent will notice when you are creating skills that are actually useful, and with your permission, it will share that across the organization in a governed way, uh, allowing everyone to benefit from the collective wisdom of everyone else in the company.
• 20:37
  SPEAKER_01: So that new hire that comes in next week can benefit from the collective wisdom of the best engineer on day one.
• 20:47
  SPEAKER_01: Um the second problem that Hermes Enterprise solves is you know the question that we all have: how is my company relevant in the age of AI?
• 20:56
  SPEAKER_01: And we believe if you look at one of the most valuable things in AI today is a trace.
• 21:03
  SPEAKER_01: And for the I know this audience is all developers, so the for the few of us that don't know what a trace is, it is essentially a problem, the tools, and the solution that an agent creates when it solves something for you in your company.
• 21:16
  SPEAKER_01: Uh and today, most of these traces basically leave the building and are fed to third parties.
• 21:23
  SPEAKER_01: Hermes Enterprise allows your company, by pairing with an agent, to capture these traces, to measure them and see which ones are the most useful to you, and essentially allow you to post-train a model that is the best in the world at doing the very thing that your company is the best in the world at solving.
• 21:41
  SPEAKER_01: And so we believe this will create self improving organizations using a sovereign stack.
• 21:49
  SPEAKER_01: And these will become very powerful organizations.
• 21:51
  SPEAKER_01: And so with great power comes great responsibility.
• 21:55
  SPEAKER_01: And we are very excited to partner with Docker to help define.
• 22:00
  SPEAKER_01: The kit specification, uh, as well as use Docker sandboxes, so that we can create self-improving organizations in a safe and responsible way.
• 22:09
  SPEAKER_01: Um so I want to thank Mark for letting me share the stage and talk with you all today.
• 22:14
  SPEAKER_01: Uh and we're very excited for our partnership with Docker.
• 22:17
  SPEAKER_01: Thank you all.
• 22:25
  SPEAKER_03: All right.
• 22:26
  SPEAKER_03: Well, I could not be more excited for us in Docker to be working with Herve and the entire new research team on this problem.
• 22:32
  SPEAKER_03: Uh, and actually for everybody in the audience, you should stay tuned for the weeks ahead because there's some really cool stuff we're cooking up uh with Hermes and sandboxes, as you might imagine.
• 22:39
  SPEAKER_03: All right.
• 22:40
  SPEAKER_03: So as I said, we think kits are gonna be a big deal, we think sandboxes are a big deal, we think these are things the ecosystem is critically needed.
• 22:46
  SPEAKER_03: But honestly, I think it's actually better to show it than actually just keep talking about it.
• 22:50
  SPEAKER_03: So to do exactly that, I'd like to welcome my esteemed colleague Michael Irwin to the stage to give us a demo.
• 22:54
  SPEAKER_03: So, Michael, come on out.
• 22:57
  SPEAKER_03: All right, what do you got cooked up for us?
• 22:59
  SPEAKER_02: Yeah, I've got some.
• 23:01
  SPEAKER_02: Good morning, everybody.
• 23:02
  SPEAKER_02: I'm excited to show off the things that we've been building.
• 23:07
  SPEAKER_02: All right.
• 23:08
  SPEAKER_02: And for full disclosure, this is pre-recorded because nobody wants to sit and watch an AI model spin for two or three minutes.
• 23:14
  SPEAKER_02: But I'm gonna start off here by actually running the same thing that uh I'm gonna start a sandbox with Claude, and I'm gonna give it that same prompt that we saw earlier where Claude was able to escape.
• 23:26
  SPEAKER_02: We're gonna ask it, can you access the secrets for my host?
• 23:31
  SPEAKER_02: Now Claude's gonna go off and it's gonna try a lot of different vectors to try to reach the host, but it's gonna conclude, yeah, I can't reach the secrets.
• 23:39
  SPEAKER_02: The isolation holds.
• 23:40
  SPEAKER_02: And in fact, if we look at the summary that's in the output here, we can see that it's found a Docker socket.
• 23:47
  SPEAKER_02: It tried to utilize it to mount other spots from the host and privileged containers, and it just couldn't get there.
• 23:54
  SPEAKER_02: And that's because the sandbox is running as a full micro VM.
• 23:58
  SPEAKER_02: There's a much stronger trust boundary in place.
• 24:00
  SPEAKER_02: Let's actually get into that sandbox and let's test out some of the other things that are here.
• 24:05
  SPEAKER_02: Because actually, it's more than just a micro VM.
• 24:08
  SPEAKER_02: The only network path out of this sandbox is through a network proxy that evaluates every request to determine should that request actually happen or not.
• 24:18
  SPEAKER_02: I'm just gonna make a simple request to curl example.com, and since that's not in my authorized list, we get an approval required.
• 24:27
  SPEAKER_02: That request just didn't make it through.
• 24:30
  SPEAKER_02: As a developer, I always have control, so I can go and actually set the policies and say, yeah, I want to allow that, go back to my sandbox, and it works immediately.
• 24:38
  SPEAKER_02: So I can always have control over the policies that work for my sandbox.
• 24:43
  SPEAKER_02: Now, what happens if I um well sorry, one of the other features that we have here is that as the request goes out, if that particular endpoint, um, let's say GitHub needs credentials, the network proxy can actually inject credentials into that flow.
• 25:00
  SPEAKER_02: And so what I'm gonna do here is I'm going to hit the GitHub API, and you'll notice I don't have any authorization headers as part of this request.
• 25:08
  SPEAKER_02: But as it leaves and goes through that network proxy, the the network proxy will inject the credentials and I'll see information about myself.
• 25:16
  SPEAKER_02: So what this means is agents can use credentials, but never has access to those credentials.
• 25:21
  SPEAKER_02: An agent simply can't leak what it doesn't have access to.
• 25:25
  SPEAKER_02: So far I've seen sandboxes that are running clawed here.
• 25:29
  SPEAKER_02: How do I customize that?
• 25:31
  SPEAKER_02: As Mark was talking about, that's where kits come into place.
• 25:34
  SPEAKER_02: As I look at Docker Hub here, I can see lots of different sandboxes.
• 25:39
  SPEAKER_02: Some that swap out the agents, I can put Pi and Hermes, I can install Playwright.
• 25:43
  SPEAKER_02: One of the ones that I've been using quite a bit lately is Code Server, where I can actually run my IDE itself inside of a sandbox.
• 25:50
  SPEAKER_02: And looking at the specification, I can see everything that this kit is going to do to my sandbox, what network endpoints it's gonna open up, the ports that it wants to run, commands it wants to run, et cetera.
• 26:00
  SPEAKER_02: I have full visibility of that.
• 26:02
  SPEAKER_02: To apply these kits, I just add them to my sandbox run command.
• 26:08
  SPEAKER_02: But you might start to notice there's a lot of flags here.
• 26:11
  SPEAKER_02: I've got some remote kits, I've got some that are uh locally found in my project, publishing ports, et cetera.
• 26:17
  SPEAKER_02: Well, one of the things that we learned with Docker Compose is there's a power that comes when I can define everything in a YAML file, commit that to my repo, and then share that with my team.
• 26:27
  SPEAKER_02: So we've done the same thing here with sandboxes.
• 26:30
  SPEAKER_02: I can open up my SBX ENV file and see basically that same configuration, but now it's in a YAML file that I can again commit to my repo and share it with my team.
• 26:40
  SPEAKER_02: Then anybody on my team can just simply run SBX ENV run, it'll use that YAML file and spin everything up.
• 26:47
  SPEAKER_02: Now, when the sandbox starts, I can continue to use Claude directly here in the terminal, but since I also added the code server kit, I can open up Locost 8080, see my IDE here, and everything that's running here is served from inside that sandbox.
• 27:03
  SPEAKER_02: That means that the Cloud Code extension you see on the side is within that trust boundary.
• 27:08
  SPEAKER_02: So I'm just gonna ask Claude, am I in a sandbox right now?
• 27:11
  SPEAKER_02: And it's gonna determine that yes, you are in a sandbox.
• 27:14
  SPEAKER_02: So one of the nice things that this provides is if I have other extensions that my team is using, and if there was a supply chain attack that happened and tries to exfiltrate data, again, there's that trust boundary around everything that's happening here.
• 27:26
  SPEAKER_02: You can more or less think of this as dev containers on steroids.
• 27:30
  SPEAKER_02: All right, so we we've seen quite a bit, but I've got one more thing I want to show.
• 27:36
  SPEAKER_02: Um, for this example, I'm gonna look at another sandbox environment file, and you'll see that this is actually using Hermes.
• 27:43
  SPEAKER_02: Um and since I've got limited time here, I want to I wanna kick off Hermes, and then I've got to run off stage.
• 27:48
  SPEAKER_02: But the question is, how do I do it when I need to close off, close down my laptop?
• 27:52
  SPEAKER_02: I can't sit here and observe it and watch it.
• 27:54
  SPEAKER_02: How do I run this agent?
• 27:57
  SPEAKER_02: Well, this time when I run my sandbox command, I'm gonna add an additional flag, this dash dash cloud.
• 28:04
  SPEAKER_02: Okay.
• 28:05
  SPEAKER_02: And now when my sandbox starts, instead of starting on this machine, it's actually gonna run out in the cloud.
• 28:10
  SPEAKER_02: And the terminal that I see here, again, is a terminal to that remote sandbox that's running.
• 28:15
  SPEAKER_02: I can continue to use Hermes here in the the uh the CLI, or I can open up the Cloud Sandbox console and access Hermes directly from the console, or I can even connect that remote sandbox to my Hermes desktop and then use the remote sandbox.
• 28:33
  SPEAKER_02: I'm gonna ask it here, hey, can you help me develop a strategy to win the developer challenge that's at the Docker booth?
• 28:39
  SPEAKER_02: And I'll give this a second just to let it go, make sure it's working.
• 28:42
  SPEAKER_02: Okay, yep, it's there.
• 28:43
  SPEAKER_02: And with that, I'll head off stage and hand it back to Mark.
• 28:46
  SPEAKER_02: Thanks all.
• 28:52
  SPEAKER_03: Awesome.
• 28:53
  SPEAKER_03: All right.
• 28:54
  SPEAKER_03: Uh can we bring the slides back up?
• 28:57
  SPEAKER_03: Awesome.
• 28:58
  SPEAKER_03: So cloud, you might say.
• 29:00
  SPEAKER_03: Well, remember I said in our factory that we needed uh capacity and reproducibility.
• 29:04
  SPEAKER_03: Well, I'm incredibly excited to announce that as of today, Docker has that machinery available.
• 29:08
  SPEAKER_03: We're announcing today Docker Cloud Sandboxes, which is a simple, flexible set of compute shapes with simple, low, low pricing.
• 29:16
  SPEAKER_03: We have cloud sandboxes that boot by uh boot in hundreds of milliseconds, uh, they're built by the second, and they have secrets, policy, networks, uh, agent config, cloud MCP gateways, all built in.
• 29:28
  SPEAKER_03: And as you just saw, importantly, it's the same look and feel, the same DX, the same kits, the same trust model as the SBX CLI.
• 29:36
  SPEAKER_03: What's important about that, if you didn't quite catch it, is that you can start locally on your laptop for free.
• 29:42
  SPEAKER_03: You can move it to the cloud, you can scale it out, again, you're not gated on capacity, and you can bring it back to your laptop whenever you want.
• 29:49
  SPEAKER_03: We think this is awesome, we think you should be excited, but if you're not excited just yet, well, actually, we're giving away$250 in free credits when you sign up with that QR code, which I'll bring up at the end of the talk, don't worry.
• 29:59
  SPEAKER_03: But also, if you stop by the booth, you'll get that in some limited editions free swag.
• 30:03
  SPEAKER_03: But that is a lot of compute to get started with.
• 30:06
  SPEAKER_03: There's nothing holding you back.
• 30:07
  SPEAKER_03: So I'm almost at time for the talk, and so what would you take away from this talk?
• 30:12
  SPEAKER_03: If you take away nothing else, you should run your agents in a sandbox.
• 30:16
  SPEAKER_03: But really, you should think of your agents as your factory, and your factory needs containment, control, choice, and capacity.
• 30:22
  SPEAKER_03: Running that factory means you have a new job.
• 30:25
  SPEAKER_03: Being the CTO of your agent team does not make engineering any less important than it was before.
• 30:29
  SPEAKER_03: It makes it more important than ever.
• 30:31
  SPEAKER_03: Because the skills that matter now are actually the skills that always mattered: judgment, taste, knowing what to ship, importantly, knowing what not to ship.
• 30:38
  SPEAKER_03: Because the models are gonna write the code and the agents are gonna write the infrastructure, but you and only you own what ships.
• 30:44
  SPEAKER_03: So, back to the question I said, oh, do you trust your agents?
• 30:47
  SPEAKER_03: And I was like, oh, kinda sorta, not entirely.
• 30:49
  SPEAKER_03: Well, still, yeah, kind of sort of, not entirely.
• 30:51
  SPEAKER_03: Because the useful metric force is not just can agents accomplish a goal, it's do they stay within the authorization boundaries on their path to doing so?
• 30:58
  SPEAKER_03: And we're just not there yet at every layer of the stack.
• 31:01
  SPEAKER_03: But risk exists on a spectrum.
• 31:03
  SPEAKER_03: You absolutely can manufacture enough trust to move with speed and safety if you start with deterministic foundations.
• 31:10
  SPEAKER_03: So if you haven't yet, start running your agents in a sandbox.
• 31:13
  SPEAKER_03: Docker has SBX, it's free, it runs on your laptop, you should try it today.
• 31:17
  SPEAKER_03: Take the agent stack you have or the one you want with Hermes and make a kit and come work with us on the spec.
• 31:22
  SPEAKER_03: It's in the open.
• 31:23
  SPEAKER_03: If you want to scale the factory out, try Docker Cloud Sandboxes, it'll scale with you.
• 31:28
  SPEAKER_03: All of this is gonna give you the machinery for the agents that are producing your software, but you still own what ships.
• 31:34
  SPEAKER_03: So go build something you can trust.
• 31:46
  SPEAKER_00: Well, what about that?
• 31:48
  SPEAKER_00: Like now we all know about what uh sandboxes and Docker has to do.
• 31:52
  SPEAKER_00: I asked them to put a sandbox on their booth, but they didn't want to do it, so that was really sad.
• 31:56
  SPEAKER_00: But yeah, great stuff, uh, really interesting.
• 31:59
  SPEAKER_00: Go to the booth, talk to them, get some more information.
• 32:01
  SPEAKER_00: Now we got a five-minute break, and then we have a change in uh in program, because the speaker that originally came couldn't get his flight, but uh luckily enough I got a friend from San Francisco coming in next.
• 32:11
  SPEAKER_00: So next up here is Laurie Voss, uh, who you might know is co-founder of MPM, and he's gonna talk to us about what code reviews are about in this world and right now.
• 32:21
  SPEAKER_00: So see you back in five minutes.
• 32:22
  SPEAKER_00: Have a coffee, have a break, have a conversation, start a company, whatever you do here in the Silicon Valley.
• 32:28
  SPEAKER_00: I'll see you in five minutes.