Botperch

CapabilitiesIsolation

Docker inside

You can run Docker containers inside the sandbox.

Short answer: 11 of 16 providers offer it fully: Blaxel, Boat, Daytona, E2B, InstaBox, Morph, Runtime, Sandboxer, Tensorlake, Vercel Sandbox and boxd. With a catch: Agent 37, Cloudflare Sandbox, Modal and Sprites. Checked 29 October 2026.

11 yes4 with a catch0 no1 not publishedChecked 29 October 2026

Who offers it

Part of Isolation: what kind of computer you get, which explains why it matters.

Fully: Blaxel, Boat, boxd, Daytona, E2B, InstaBox, Morph, Runtime, Sandboxer, Tensorlake and Vercel Sandbox. With a catch: Agent 37, Cloudflare Sandbox, Modal and Sprites.

  • BlaxelYesdocker-in-sandbox image

    docs-confirmed “Blaxel provides a ready-to-use sandbox image (blaxel/docker-in-sandbox) with everything you need to build and run Docker images.” Source

  • BoatYesDocker, Compose, BuildKit

    docs-confirmed “Docker with BuildKit and Compose, on the sandbox's own kernel.” Source

  • boxdYesDocker preinstalled

    docs-confirmed “Docker Engine, Compose, and Buildx come pre-installed on every machine, with the daemon already running.” Source

  • DaytonaYesDocker-in-Docker

    docs-confirmed “Sandboxes can run Docker containers inside them (Docker-in-Docker)” Source

  • E2BYesDocker image documented

    docs-confirmed “Sandbox with Docker or Docker Compose installed for running containers” Source

  • InstaBoxYesDocker on default image

    The herdr and orca templates ship without Docker.

    docs-confirmed “Docker with Compose” Source

  • MorphYesDocker-in-Docker

    docs-confirmed “docker” Source

  • RuntimeYesenable-docker

    Docker is not installed until you run the enable-docker command.

    docs-confirmed “enable-docker installs Docker Engine, Buildx and Compose from Ubuntu's archive, and starts them.” Source

  • SandboxerYesDocker preinstalled

    docs-confirmed “Docker with BuildKit and Compose” Source

  • TensorlakeYesneeds ubuntu-systemd image

    Docker needs the systemd image; the default minimal image has no init system.

    docs-confirmed “Required for workloads needing service management, such as Docker or Kubernetes, within the sandbox.” Source

  • Vercel SandboxYesDocker inside

    docs-confirmed “Run Docker and other container engines inside the sandbox to build images or run containerized workloads.” Source

  • Agent 37With a catchVM type only

    The catch: Docker only works on the 2.5x VM type; the default machine cannot run a Docker daemon.

    docs-confirmed “The default gVisor instance type cannot run a Docker daemon.” Source

  • Cloudflare SandboxWith a catchdocker:dind, no iptables

    The catch: Docker works through a special image, but the firewall tool Docker normally uses is turned off, so container networking is limited.

    docs-confirmed “Yes. Use the docker:dind image, and start the Docker daemon with iptables and IP forwarding turned off” Source

  • SpritesWith a catchDocker, with limits

    The catch: Docker runs, but some containers fail and the usual service manager is missing, so services need the provider's own manager instead.

    Reported by a Fly community user, not stated in the docs.

    third-party “will fail for any container whose PID 1 is non-root” Source

  • LizardNot published

    The docs never say whether a Docker daemon runs inside a sandbox.

    not-published “Choose a template from the current catalog” Source

Related

Other capabilities in this feature

Where it decides the choice

The feature

Words used here

  • IsolationHow firmly one machine is kept apart from others on the same hardware. A microVM is a small full computer and is the stronger wall; a container shares more with its neighbours.

Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.