predictionguard/sbx-predictionguard

By predictionguard

•Updated 2 days ago

Docker Sandbox kit for Prediction Guard. Network-isolated, credential-proxied AI coding agents.

Sandbox Kit

Security

Machine learning & AI

299

Overview Tags

predictionguard/sbx-predictionguard repository overview

Tag

Base Imagedocker/sandbox-templates:opencode-docker

Digest

sha256:13474b5cd113…

Size

425 Bytes

Schema

Pushed

2 days ago

Specificationspec.yaml

SANDBOX KIT

REQUIRES SECRETS

Run AI coding agents inside Docker Sandbox with Prediction Guard as the model provider — network-isolated, credential-proxied, with prompt injection and PII protection built in

Credentials

Name	Service	Required	Description
`PREDICTIONGUARD_TOKEN`	predictionguard	Optional	—

Network Egress

pg.yourcompany.com

Run in a Sandbox

sbx run docker.io/predictionguard/sbx-predictionguard:latest

Make sure you have docker sbx installed

Run the following command to install sbx on your machine.

macOS

brew install docker/tap/sbx

Windows

winget install Docker.sbx

Learn more about docker sbx⁠

⁠Prediction Guard sandbox kit for Docker Sandboxes

Run AI coding agents (OpenCode) inside a Docker Sandbox⁠ with Prediction Guard⁠ as the model provider — network-isolated, credential-proxied, with prompt injection and PII protection built in.

⁠How it works

Two components. Both required.

┌─────────────────────────────────────────────┐     ┌──────────────────────────────────────┐
│         Developer machine / cloud VM        │     │   Your infrastructure (self-hosted)  │
│                                             │     │                                      │
│  ┌──────────────────────────────────────┐   │     │  ┌────────────────────────────────┐  │
│  │       Docker Sandbox (Gate 1)        │   │     │  │  Prediction Guard (Gate 2)     │  │
│  │                                      │   │     │  │                                │  │
│  │  ┌────────────────────────────────┐  │   │     │  │  • Prompt injection detection  │  │
│  │  │     AI coding agent            │  │   │     │  │  • PII detection & redaction   │  │
│  │  │     (OpenCode)                 │──┼───┼────▶│  │  • Toxicity policy             │  │
│  │  └────────────────────────────────┘  │   │     │  │  • Model inventory & routing   │  │
│  │                                      │   │     │  │  • Audit log                   │  │
│  │  • Network: only pg.yourcompany.com  │   │     │  └────────────────────────────────┘  │
│  │  • Credential proxy: key never       │   │     │                                      │
│  │    enters the VM                     │   │     │         ┌──────────────┐             │
│  │  • Filesystem: mounted workspace     │   │     │         │  LLM / Model │             │
│  │    only                              │   │     │         └──────────────┘             │
│  └──────────────────────────────────────┘   │     └──────────────────────────────────────┘
└─────────────────────────────────────────────┘

Gate 1 — Docker Sandbox isolates the agent at runtime: network, filesystem, and credentials are locked down before the agent starts. The API key never enters the VM.

Gate 2 — Prediction Guard governs every model call: prompt injection, PII, and content policy are enforced on live traffic before it reaches the model. Runs entirely inside your own infrastructure.

⁠Quick start

echo "$PREDICTIONGUARD_TOKEN" | sbx secret set-custom -g \
  --host pg.yourcompany.com \
  --env PREDICTIONGUARD_TOKEN \
  --placeholder sk-pg-placeholder

Then run:

sbx run --kit docker.io/predictionguard/sbx-predictionguard:latest predictionguard

Replace pg.yourcompany.com with your Prediction Guard deployment URL.

Need a Prediction Guard deployment? Get your evaluation license →⁠

⁠What this kit does

Network isolation — outbound traffic restricted to your Prediction Guard endpoint only; default deny for everything else
Credential proxy — your API key stays on the host and is never exposed inside the sandbox VM
Model-layer governance — every AI call passes through Prediction Guard's prompt injection detection, PII anonymization, and toxicity policies before reaching the model

⁠Two gates of defense

Docker Sandbox handles the runtime layer (what the agent can reach on the host and network). Prediction Guard handles the model layer (what content goes in and out of the AI). Neither gate alone is sufficient — together they enforce least-privilege at both layers.

Read the full writeup: Two Gates of Defense — predictionguard.com/blog⁠

⁠Meet us at WeAreDevelopers World Congress

We will be at the Docker Pavilion, Sep 23-25, San Jose. Come see a live demo of both gates in action — Docker Sandbox + Prediction Guard running together.

Book time with us at the conference →⁠

⁠Source

github.com/predictionguard/docker-pg-experiment⁠