Products | Docker

Secure, minimal container images for every team, free with enterprise features, if needed.
Let agents read, write, and run code without risking your machine
Run all your agents in fully isolated environments
No Docker Desktop required, just install and go
Every agent gets its own microVM with its own kernel. Your files, your secrets, your machine stay yours.
Sandboxes start up near instantly. Isolation stops costing you speed in the inner loop. Hand long runs to Docker’s cloud. Same sandbox, same CLI.
A full dev environment, Docker included. Agents build, run, and test like any developer on the team.
Set network and filesystem limits per sandbox. Denied domains don’t even resolve.
Roll out agents org-wide without losing sight of them
One policy for every machine, no local overrides
Every policy decision logged and streamed to your SIEM
Agents act in two ways: running code and calling tools. Docker manages both, so policy always holds at execution.
Set network and filesystem rules once. They replace local rules on every sandbox in your org.
Every allow and deny is logged with who, what and which rule, ready for your SIEM.
Require org sign-in through endpoint management, so policy always applies.
Know every MCP server your agents are running, org-wide
Connect every agent through one gateway you control
Credentials never end up in an agent’s context or a config file
Agents connect to the Gateway once and reach every tool you’ve approved. One place to see what’s in use, add what’s needed, and revoke what isn’t.
MCP Enterprise Gateway signs in to each tool and passes credentials only at call time. Agents can use the tool, they never see the key.
Every server in the MCP Catalog is vetted, signed, and containerized by Docker. New capability for your agents, nothing unknown on your machines.
Cut your CVE backlog without changing how you build
Prove what’s in every image you ship
Migrate by changing one line
Hardened Images strip out shells, package managers, and everything else an attacker could use. Less surface, fewer CVEs, quieter scanners.
Images stay at near-zero known CVEs, with critical fixes in seven days. Independently assessed by SRLabs.
Every image ships with a signed SBOM and build provenance. When the auditor asks…show, not tell.
Scout reads your images, flags what’s vulnerable, and surfaces the fix in CI. Remediation moves ahead of release.
Every developer gets the same environment, on any OS
Trusted content one pull away
Managed centrally, from ten developers to tens of thousands
Desktop puts the same environment on every Mac, Windows, and Linux machine. “Works on my machine” retires.
Hub keeps Official Images and Verified Publisher content one pull away. Teams build on vetted sources, not luck.
SSO, managed settings, and access controls, administered from one place. The controls your org expects, invisible to developers.
“Docker Sandboxes have the best DX of any local AI coding sandbox I’ve tried.”
Creator, Total TypeScript
“We chose Docker Hardened Images for its alignment with our supply chain security posture, developer tooling compatibility, and Docker’s maturity in this space.”
Walmart’s data science teams build and test with Docker Desktop before anything ships.