Source: Docker Blog — 2026-08-14

Summary

Docker Captain Marco Franzon walks through building reproducible ESP32 microcontroller firmware inside pinned Docker containers, then extends the workflow into Docker Sandboxes — microVM-isolated environments where an AI coding agent can build, flash, and monitor real physical hardware unsupervised, without ever touching the host machine directly. The post shows how serial hardware access is bridged into both regular containers and isolated sandboxes over the network, so agents can work with actual boards while staying fully contained.

Key Takeaways

• The baseline fix for "works on my machine" firmware bugs is pinning the exact espressif/idf image version (e.g. release-v5.4) instead of latest, combined with running as the host's own UID so build artifacts aren't left root-owned.
• Serial hardware access — flashing and monitoring a physical board — is bridged over the network using esp_rfc2217_server on the host, letting a container or sandbox that has no direct USB access still flash and talk to real hardware via rfc2217://.
• Multiple parallel firmware environments (e.g., a legacy production build on one IDF version, an experimental feature on another) run side-by-side using udev rules keyed to USB serial numbers, giving each board a stable device path that survives reboots and replugging.
• Docker Sandboxes launch via a simple sbx run claude command, giving an AI coding agent a private kernel, filesystem, network stack, and Docker daemon — so it can build, install packages, and flash a real board unsupervised without any of that touching the host.
• Credentials are injected by a host-side proxy that the sandbox never sees directly, and network policy is configurable across open, default-deny, and fully locked-down modes — letting an agent get real hardware access without also getting your API keys.

Reel Script

Hook: Letting an AI coding agent run unsupervised is one thing when it's editing text files. It's another thing entirely when the "file" it's about to modify is the firmware on a physical circuit board sitting on your desk. Here's how you do that without handing the agent your actual laptop.

Core Concept: Embedded firmware development has a reproducibility problem that regular software mostly solved years ago — different toolchain versions on different machines produce firmware that behaves differently on the same hardware, which is a nightmare to debug. The fix here is standard container discipline: pin your build image to an exact version, never latest, so everyone's build environment is bit-for-bit identical. But the harder problem is hardware access — a physical board is plugged into one specific USB port on one specific machine, and a container is, by design, isolated from that. The solution is a network serial bridge: a small program on the host exposes the board's serial connection over the network, and anything that can make a network connection — a container, or even a fully isolated microVM sandbox on a different machine entirely — can then flash and monitor that real board as if it were plugged in locally.

Hands-On: Picture three environments converging on the same pinned toolchain: your regular dev container, doing docker run with the pinned espressif/idf image and the host UID passed in so build files aren't left root-owned; a CI pipeline, running the identical pinned image inside GitHub Actions to catch drift before merge; and a Docker Sandbox, spun up with a one-line sbx run claude command, giving an AI agent its own private kernel and filesystem to work in. The connective piece across all three is that serial bridge — esp_rfc2217_server running on the host, and any of those three environments pointing at it with idf.py --port 'rfc2217://host.docker.internal:4000' flash monitor to build and push real firmware onto the actual board. That means the AI agent in its sandbox can genuinely flash and test against physical hardware, fully isolated from your host filesystem and credentials, which are injected by a separate host-side proxy the sandbox never directly sees.

Takeaway: If you're experimenting with agentic coding tools on anything touching real hardware, this is the pattern to copy — isolate the agent completely, bridge only the specific hardware access it needs, and never let it hold your credentials directly. Go set up the serial bridge before you give an agent write access to anything with a physical circuit attached.

Discussion