> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Docker Sandboxes sandboxes

> Run CostGraph workflows and CI jobs in Docker Sandboxes sandboxes: the key to create, its permissions, and its limits

Docker Cloud Sandboxes are Docker-hosted cloud sandboxes created from images that you control through the Docker Sandboxes API and TypeScript SDK.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | Yes | Integrations or your own dispatcher |

## Connect

Connect Docker Sandboxes on Integrations, and CostGraph starts sandboxes in your Docker Sandboxes account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Docker Sandboxes**.

2. Enter these fields:

   * **Docker ID** (`DOCKER_USERNAME`, required): Your Docker ID.
   * **Personal access token** (`DOCKER_PAT`, required): A Docker personal access token with Cloud Sandboxes access.

3. Click **Connect**.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `dockercloud` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

## Key and permissions

DOCKER\_USERNAME is your Docker ID; DOCKER\_PAT is a Docker personal access token created in Docker account settings > Personal access tokens with 'Allow Cloud Sandboxes access' selected. Requires an active Docker Agentic Platform subscription.

The PAT needs the sandbox:use scope (granted by 'Allow Cloud Sandboxes access'); registry permissions alone do not grant access, and no repository permission is needed. The account must also hold sandboxesCreate, sandboxesRead, sandboxesDelete, sandboxesExec and sandboxesCredential (exec). A list-specific permission is not documented.

Sources: [docs.docker.com: authentication](https://docs.docker.com/ai/sandboxes-api/authentication.md), [docs.docker.com: limits](https://docs.docker.com/ai/sandboxes-api/limits.md), [docs.docker.com: sandboxes api](https://docs.docker.com/ai/sandboxes-api/), [docs.docker.com: personal access tokens](https://docs.docker.com/security/access-tokens/personal-access-tokens/).

## Limits

* Sizes from micro (1 CPU / 2 GiB) to xl (16 CPU / 32 GiB). ([source](https://docs.docker.com/ai/sandboxes-api/limits.md))
* Default account quotas: 10 concurrent sandboxes, 50 stored sandboxes (stopped sandboxes still count). ([source](https://docs.docker.com/ai/sandboxes-api/limits.md))
* Max lifetime, idle stop, regions and architecture are not documented on these pages. ([source](https://docs.docker.com/ai/sandboxes-api/))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.