Hacker News Reader

> So what "sandboxing" does this add that is not already present in Docker

Docker Sandbox spawns a micro VM, not a standard container isolated by host kernel mechanisms (Linux namespaces etc.)

Does it come with the downsides of standard VMs? (Dedicated resources like memory and CPU cores, virtual disk images.)

Yes, though since it's a "micro" VM, it shouldn't take up nearly as many resources as a regular VM. Some hypervisors also implement memory ballooning to not take up memory that's not being used, but I'm not sure whether Docker Sandbox's hypervisor implements that.

Reply on news.ycombinator.com