Docker and GitGuardian have introduced a new integration that brings GitGuardian’s secret scanning into Docker Sandboxes used by AI coding agents.
Announced on September 24, 2026, the integration is delivered through the GitGuardian Sandbox Mixin Kit. The kit installs GitGuardian’s ggshield secret scanner inside a Docker Sandbox and configures its AI-agent hooks.
The integration combines Docker’s sandbox isolation with GitGuardian’s existing secret detection technology. Docker provides the isolated environment, while GitGuardian scans interactions between developers, AI agents and their tools.
Docker Sandboxes run AI coding agents inside isolated microVMs. Each sandbox has its own kernel and Docker daemon, allowing an agent to install packages, execute commands and run containers without direct access to the host system.
Docker describes its security model as using multiple isolation layers covering the hypervisor, network, Docker Engine, workspace and credential proxy. More details are provided in Docker’s Sandbox security documentation.
GitGuardian adds secret detection to the agent workflow through three types of hooks.
When a user submits a prompt, the integration can scan it before the prompt reaches the AI model. A detected secret blocks the prompt.
Before an AI agent uses a tool, the integration can scan file reads, shell commands and MCP calls. A detected secret blocks the action.
After a tool runs, GitGuardian can scan the resulting output. A detected secret generates a desktop notification rather than stopping an operation that has already completed.
GitGuardian says the same detection engine is used across these hooks and currently covers more than 600 types of secrets. Its AI Hooks documentation describes the broader system in detail.
The Docker integration is documented for Claude Code, Codex, GitHub Copilot and Cursor.
GitGuardian’s wider AI-hook system also supports Copilot CLI, VS Code and Mistral Vibe, but those broader integrations are separate from the four-agent list associated with the Docker Sandbox announcement.
The sandbox setup also changes how the GitGuardian API credential is handled.
The real GitGuardian API key is stored on the host rather than being placed directly inside the sandbox. Within the microVM, GITGUARDIAN_API_KEY is represented by a proxy-managed placeholder.
When ggshield connects to GitGuardian’s API, Docker’s sandbox proxy can replace the placeholder with the real credential in the outbound authorization request.
The published kit specification states that the real API key does not enter the sandbox filesystem, shell history, environment or process list.
The kit also defines network access for GitHub and GitGuardian services, including github.com, objects.githubusercontent.com, release-assets.githubusercontent.com and api.gitguardian.com.
Those network rules are additive rather than a complete deny-all policy. Docker’s active network configuration can still permit other destinations. GitGuardian recommends a restrictive network policy when those hosts are intended to be the complete allowlist.
The integration does not remove the need to protect files that are deliberately exposed to an AI agent. Docker’s security documentation warns that clone mode can expose files under the Git root, including .env files, untracked files and files excluded through .gitignore.
This means Docker’s isolation and GitGuardian’s scanning operate at different levels. The sandbox limits where an AI agent can operate and what it can access, while GitGuardian checks prompts, tool activity and tool output for secrets.
There is also a limitation in the current hook design. GitGuardian’s documentation says the AI hook fails open when scanning cannot be performed, such as when the API is unreachable or authentication fails. In that situation, the action is allowed to continue.
The post-tool hook also works differently from the preventive checks. It can detect secrets in output and notify the user, but it does not prevent a tool operation that has already taken place.
GitGuardian’s scanning process also involves sending content to its service for detection. Its documentation states that AI-hook scanning is performed through the GitGuardian API, including information associated with MCP tool calls.
The announcement comes as Docker expands its broader sandbox platform for AI agents.
Docker introduced its current microVM-based Sandboxes in January 2026 as isolated environments for coding agents such as Claude Code, Codex, Copilot CLI and Gemini CLI. The company later expanded the system with Cloud Sandboxes, allowing sandbox workloads to run on Docker-managed infrastructure.
Docker announced Cloud Sandboxes on September 24, 2026. The service uses the same general sandbox model and CLI across local and cloud environments.
Docker lists Cloud Sandbox pricing from $0.07 per hour for a configuration with one vCPU and 2 GiB of memory to $1.12 per hour for 16 vCPUs and 32 GiB of memory. Compute is metered by the second, paused sandboxes do not incur compute charges, and model-provider costs are separate.
The GitGuardian integration is built around Docker’s newer Kit system. Kits can define software, environment variables, credentials, network permissions, files, startup commands and agent instructions for a sandbox.
Docker says Kits can be distributed through OCI registries, Git repositories or local files, allowing sandbox configurations to be reused across environments.
Docker published version 3 of its Sandbox Kit specification on September 24, 2026, alongside work with the Cloud Native Computing Foundation around an open specification for agent permissions.
The company’s current documentation identifies Kits as an early-access feature, with the format, commands and user experience subject to change.
The current Docker Sandboxes release notes list version 0.45.0, released on September 21, 2026, with version 3 Kits and reusable mixins among the newer capabilities.
The GitGuardian kit currently pins ggshield version 1.53.0. Its repository says the package has not been moved to version 1.54.0 because of a certificate-bundle problem. Mistral Vibe support was added in version 1.54.0, which is another reason the broader GitGuardian AI-hook support list is different from the Docker kit’s current agent coverage.
GitGuardian’s push into AI-agent security follows a series of releases focused on preventing secrets from being exposed through AI development workflows.
Its State of Secrets Sprawl 2026 report said that 28.65 million new hardcoded secrets were found in public GitHub commits during 2025, representing a 34 percent increase from the previous year.
The same report identified 1,275,105 AI-service secrets, an 81 percent increase.
GitGuardian also reported that 24,008 unique secrets were found in public MCP configuration files, including 2,117 valid credentials.
In separate research on AI-assisted development, GitGuardian reported a 3.2 percent secret-leak rate for Claude Code-assisted commits compared with a 1.5 percent baseline across public GitHub commits. The company said the figures should not be interpreted as proof that Claude Code itself causes the leaks.
GitGuardian had already released secret scanning for AI coding tools before the Docker partnership. Its AI-hook system was designed to scan prompts, file reads, shell commands, MCP calls and tool output.
The company later expanded its developer security work through Developer Endpoint Protection and additional AI-agent and MCP inventory capabilities.
The new Docker Mixin Kit packages that existing GitGuardian functionality into a Docker Sandbox environment, making secret scanning part of the sandbox configuration rather than a separate manual step for each project.
GitGuardian currently offers a free Starter plan for up to 25 developers, with unlimited real-time scanning and 10,000 API calls per month. The company’s higher-tier offerings include additional endpoint-protection capabilities. The GitGuardian sandbox kit requires an API key with at least the scan scope, and its documentation recommends using a dedicated scan-only credential.
The GitGuardian Sandbox Mixin Kit, Docker Sandbox documentation and GitGuardian AI-hook reference provide the implementation details for developers working with the integration.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
