sandbox

Docker alternatives for AI agents: Podman, bwrap and Firejail

Luigi

• 3 min read
Share
Docker alternatives for AI agents: Podman, bwrap and Firejail

Docker won the container wars. But for AI coding agents — tools that write, run, and debug code autonomously — Docker is not always the right answer.

Agents are different from microservices. They run short-lived commands, not long-lived servers. They need isolation from your SSH keys, not port mapping. And they need to start fast — a 3-second Docker spin-up feels glacial when the agent launches 20 sandboxes per task.

Three alternatives have emerged: Podman, Bubblewrap (bwrap), and Firejail. Each solves a different problem.

The Problem

AI coding agents run arbitrary code at machine speed. That code can be buggy, malicious, or prompt-injected.

"Agent decided to test if harmful command block worked by issuing a rm -rf /" — Reddit, r/LocalLLaMA

The post got 355 upvotes. The user had implemented a bubblewrap sandbox. It worked.

Podman: Docker Without the Daemon

Same OCI standards. Same Docker-compatible CLI. Rootless by default, daemonless by design.

Why it works for agents:

  • Rootless containers. No root-owned daemon socket.
  • Quadlets and systemd integration. Run an agent as a systemd user service.
  • podman play kube — test Kubernetes YAML locally.
  • Pods. Group agent tools into one pod.

Where it falls short:

  • ~100-500ms startup. Noticeable for short-lived per-task sandboxes.
  • GPU passthrough requires CDI + SELinux workarounds.
  • macOS/Windows need Podman Machine (a Linux VM).

Best for: Production agent services. Multi-tenant CI. Kubernetes-compatible isolation.

Bubblewrap (bwrap): The 50ms Sandbox

~8k lines of C. Used by Flatpak and Codex CLI. Starts in under 50ms.

Why it works for agents:

  • Sub-second startup. Create and destroy sandboxes per-command.
  • No daemon, no root. Pure user namespaces.
  • Minimal attack surface. Full TOCTTOU protection.
  • Drops all capabilities. Zero Linux capabilities for the sandbox.
  • Explicit filesystem control. Every path is deliberate.
"bwrap is much more honest: it's just a syscall wrapper, zero required privilege." — Hacker News

Projects using bwrap for agents:

  • bubblewrap-ai — Runs Claude, Gemini, Goose in a bwrap sandbox.
  • sandbox-bwrap-nix — Allows to run Opencode or other AI harnesses with nix, so it can install missing softwares as normal user without polluting the host system.
  • Codex CLI — OpenAI uses bwrap for code execution isolation.
  • Claude Code — Anthropic reported 84% reduction in permission prompts with bwrap sandboxing.

Where it falls short:

  • Linux-only. No macOS or Windows.
  • No image management. Manual bind-mounts.
  • No built-in resource limits.

Best for: Per-command agent sandboxes. Local development. CI pipelines.

Firejail: Sandboxing for the Rest of Us

SUID program with ~1000 pre-built profiles for Firefox, Chrome, Telegram, GIMP, and more.

Why it works for agents:

  • Zero configuration. firejail agent.sh works out of the box.
  • Pre-built profiles. Two words: firejail firefox.
  • X11/Wayland isolation via built-in Xephyr support.
  • Landlock support (experimental). Filesystem access without capabilities.
  • Seccomp-log. Debug syscalls without blocking them.
"Firejail knows about Pulseaudio; bubblewrap does not." — bubblewrap README

Firejail is opinionated about desktop integration. For AI agents, minimal is usually better.

Where it falls short:

  • SUID binary. Larger attack surface than bwrap.
  • Blacklist-based profiles (mostly). Migrating to whitelists, but slowly.
  • Built for desktop apps, not agent per-command patterns.

Best for: Browser-based agents. Desktop AI tools. "Just make it safe" without reading docs.

Decision Matrix

CriterionPodmanbwrapFirejail
Startup time~100-500ms<50ms<50ms
Isolation strengthHigh (ns + cgroups)Medium (namespaces)Medium-High (ns + seccomp + Landlock)
RootlessDefaultYesYes (user ns)
Attack surfaceLarge (150k+ LOC Go)Minimal (8k LOC C)Medium (50k+ LOC C, SUID)
Pre-built profilesNoNoYes (~1000)
Image managementYes (OCI)NoNo
PortabilitymacOS, Windows (VM)Linux onlyLinux only
GPU supportYes (CDI)Manual (/dev/dri)Manual
Best use caseProduction agent servicesPer-command sandboxesDesktop agent isolation

The Bottom Line

For production agent infrastructure — multi-tenant, GPU-backed, CI-integrated — use Podman. Rootless, daemonless, systemd-native.

For local agent development — Claude Code, Codex CLI, custom scripts — use bwrap. Milliseconds startup, no setup, minimal surface. This is why Codex and Claude Code ship with built-in bwrap sandboxes.

For desktop agents — browser automation, GUI tools, "make Firefox safe" — use Firejail. The 1000 pre-built profiles make it the most practical choice.

And if you need stronger isolation than any of these? MicroVMs (Firecracker, gVisor, Kata). But that is a different post.