Chainloop Partners with Docker: Governed Agentic Development from Sandbox to Pull Request

Chainloop has partnered with Docker. Chainloop now runs inside Docker Sandboxes: a coding session that runs there is recorded as a signed attestation, checked against your policies, and the result posts on the pull request it produced.

Chainloop helps enterprises build with AI without losing control of what ships. AI sessions, builds, scans, SBOMs and releases land in one signed graph, checked by one policy engine, so every change can be followed from the prompt that asked for it to the release that carried it. The Docker Sandboxes kit is one place it plugs in.

Docker invited us to show it on their booth stage this week at WeAreDevelopers World Congress North America in San José.

Why Docker and Chainloop

Coding agents edit files, run commands, call MCP servers, and open pull requests, usually with the developer’s own credentials. Docker Sandboxes put each one in its own small virtual machine, with its own kernel, filesystem, and network. Docker AI Governance decides what that agent can reach: which networks, which files, which credentials, which MCP tools. Every decision is logged.

That settles what the agent was allowed to touch. The second question is the one we get asked in most security reviews: what did the agent actually do, and how does it connect to what shipped? When a person writes the code, the code is the record. When an agent writes it, most of what matters never reaches the diff. The prompt, the tools it called, the files it rewrote and what it all cost live in the session, and none of it is kept as evidence anyone can check later. Docker’s log proves the agent stayed inside its boundary. Chainloop’s attestation proves what it produced and whether that meets your policy, and it puts the session in context: the same signed graph holds the commit it made, the pull request it opened, the scans and SBOM on that commit, and the release it ended up in. A line of code traces back to the prompt that asked for it, and forward to production.

A session that ran in a Docker Sandbox, kept: the agent and model, the signed attestation, the pull request it opened, what it changed, and what it cost.

One Kit, No Change for Developers

The kit wraps the Claude Code agent that Docker Sandboxes already ship. That is the scope today, and more agents are next. Nothing else about how developers work changes.

The same session on the pull request. Reviewers get the score and the breakdown without leaving GitHub.

Not every session is clean, and that is the point of the check. Run each policy as advisory, or as a gate that blocks the merge.

On an earlier run, the no-secrets policy caught a GitHub token and a JWT in tool output, pinned to the exact turn.

The attestation uses open formats, in-toto signed with Sigstore or your own keys, and the core is open source, so the record outlives any one vendor’s tooling.

What You Get

• Developers keep the workflow they already have. Starting a session is sbx run with the kit name and a Chainloop token.
• Security teams get a check on every session the kit records, not a sample: sanctioned agents only, allowed MCP servers only, no dangerous commands, no leaked secrets. When something does slip through, the graph shows which session produced which commit, pull request and release.
• Compliance and audit teams get signed evidence in open formats, connected from prompt to production, that maps to SLSA, NIST SSDF, NIST AI RMF, and the EU Cyber Resilience Act.
• Engineering leaders see which agents, models, and tools their teams use, what each costs per pull request, and which ones produce the best results.

Get Started

The Chainloop kit for Docker Sandboxes is available today. If you are at WeAreDevelopers this week, the live demo, Signed Provenance for Sandboxed Agents, is on the Docker booth stage in San José on Friday, September 25 at 1:15 PM PDT. If you are reading this later, the demo videos cover the same ground.

• Run the kit with the Docker Sandboxes guide.
• See what a session captures and how the merge is gated at chainloop.dev/ai-sessions, or record your first one with the AI sessions quickstart.
• Book a demo to see Chainloop with Docker Sandboxes.
• Contact us to talk about your environment.