AI Agents Need to Run Code

An AI coding agent is not just a chatbot. It can:

• Read & write any file it can access
• Run arbitrary shell commands
• Download data from the internet
• Install software packages

The Solution: A Sandbox

Docker = an isolated mini-computer inside your real computer.

Three Concepts You Need

Why Docker for AI Agents?

Docker Desktop is Free for Education

Two options for Windows users:

Mac users: Docker Desktop is the standard choice.

Windows + Docker Desktop

Step 1: Install WSL 2 (PowerShell as Admin)

wsl --install

Restart. Set a Linux username and password.

Step 2: Download Docker Desktop from docker.com/products/docker-desktop

Run installer, keep defaults, restart if asked.

Step 3: Configure Docker Desktop

• Settings → General: ✅ “Use WSL 2 based engine”
• Settings → Resources → WSL Integration: ✅ Ubuntu

⏱ Total: ~15 min including restarts

Windows: Verify & Configure

Step 4: Open Ubuntu (NOT PowerShell!) and run:

docker run hello-world

You should see “Hello from Docker!”

Mac: Step by Step

Step 1: Check your chip (Apple menu → About This Mac)

• M1/M2/M3/M4 = Apple Silicon
• Otherwise = Intel

Step 2: Download Docker Desktop from docker.com/products/docker-desktop

Choose your chip type. Open .dmg, drag to Applications.

Step 3: Open Docker, grant permissions, accept agreement.

Step 4: Open Terminal and verify:

docker run hello-world

⏱ Total: ~10 min

Alternative: Docker Engine in WSL 2 (No Desktop)

For Windows users who prefer a lightweight, CLI-only setup:

Step 1: Install WSL 2 (same as before: wsl --install, restart)

Step 2: Open Ubuntu terminal, install Docker Engine:

# Add Docker repo + install (full commands in handout)
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli \
  containerd.io docker-buildx-plugin docker-compose-plugin

Step 3: Start Docker manually each session:

sudo service docker start

⏱ ~15 min · Full step-by-step in the handout, Part 2 Option B

WSL 2 Docker Engine: Tips

What Goes Into the Dockerfile

Docker caches every layer. Change the last layer only? Rebuild in seconds.

Installing R

# Install R
RUN apt-get update && \
    apt-get install -y r-base r-base-dev && \
    rm -rf /var/lib/apt/lists/*

# Install R packages (~10-15 min)
RUN Rscript -e "install.packages(c(
    'tidyverse', 'fixest', 'modelsummary',
    'haven', 'data.table', 'ggplot2'
    ), repos='https://cloud.r-project.org', Ncpus=4)"

R packages are pre-installed in the Dockerfile — you wait once, not every time.

Installing Python, AI Agents, and Stata?

# Python
RUN apt-get install -y python3 python3-pip
RUN pip3 install numpy pandas matplotlib

# Node.js (needed for Codex and Gemini CLI)
RUN curl -fsSL https://deb.nodesource.com/setup_24.x | bash -
RUN apt-get install -y nodejs

# Claude Code
RUN curl -fsSL https://claude.ai/install.sh | bash

# OpenAI Codex
RUN npm install -g @openai/codex

# Google Gemini CLI
RUN npm install -g @google/gemini-cli

Customize It — Ask an LLM!

The provided Dockerfile is a starting point. Want to add packages or tools?

Building the Image

cd ~/coding-agent-workshop
docker buildx build -t coding-agent .

Starting a Container

# Start in background
docker compose up -d

# Enter the container
docker exec -it my-agent bash

Volume Mounts: Host ↔︎ Container

~/project/
  workspace/    ← shared
  output/       ← shared
  CLAUDE.md     ← shared (read-only)
  my-photos/    ← NOT shared
  passwords.txt ← NOT shared

/home/agent/
  project/   ← agent works here
  output/    ← results go here
  CLAUDE.md  ← agent reads this

  (everything else is
   invisible to the agent)

Only explicitly mounted folders are visible. Everything else stays private.

The docker-compose.yml

services:
  agent:
    image: coding-agent
    container_name: my-agent
    stdin_open: true
    tty: true
    mem_limit: 16g            # Max RAM
    cpus: 4                   # Max CPU cores
    pids_limit: 512           # Max processes
    volumes:
      - ./workspace:/home/agent/project
      - ./output:/home/agent/output
      - ./CLAUDE.md:/home/agent/CLAUDE.md:ro
      - agent-auth:/root/.claude

volumes:
  agent-auth:

Claude Code: Option A — API Key

Pay per use. You control spending via the API dashboard.

1. Go to platform.claude.com
2. Create account → “API Keys” → “Create Key”
3. Add $5–10 billing credit

# Inside the container:
export ANTHROPIC_API_KEY="sk-ant-your-key-here"
claude

The key starts with sk-ant-... — save it somewhere safe.

Claude Code: Option B — Max Subscription

Flat monthly fee. No per-token charges.

Subscribe at claude.ai (Pro $20/mo, Max $100–200/mo)

# Inside the container:
claude

Copy URL → open in browser → log in → done. Saved in Docker volume.

OpenAI Codex

Open source (Apache 2.0) — github.com/openai/codex

# Inside the container:
export OPENAI_API_KEY="sk-your-key-here"
codex

Get a key at platform.openai.com → API Keys

codex exec "fix the failing tests" --full-auto

Google Gemini CLI

Open source (Apache 2.0) — github.com/google-gemini/gemini-cli

# Inside the container:
export GEMINI_API_KEY="your-key-here"
gemini

Get a key at aistudio.google.com → API Keys

gemini          # Browser login on first run

Verify Everything Works

claude --verbose

The Risk: Filling Up Your Disk

Solution: Give Docker its own storage area with a hard size cap.

Three Levels of Protection

Workshop recommendation: Option A is sufficient. See handout Part 14 for Options B & C.

Option C: Size-Limited Workspace

Mac:

hdiutil create -size 30g -fs APFS -volname AgentWorkspace \
  -type SPARSE ~/agent_workspace.sparseimage
hdiutil attach ~/agent_workspace.sparseimage
# Use /Volumes/AgentWorkspace in docker-compose.yml

Windows (WSL):

dd if=/dev/zero of=~/agent_workspace.img bs=1M count=30720
mkfs.ext4 ~/agent_workspace.img
mkdir -p ~/project/workspace
sudo mount -o loop ~/agent_workspace.img ~/project/workspace

Agent fills up the 30 GB? It stops. Your system stays safe.

Option A: Move Docker to a Separate Drive

Mac: Docker Desktop → Settings → Resources → Disk image location → Browse → select external drive. Done.

Windows (PowerShell as Admin):

wsl --shutdown
wsl --export docker-desktop-data D:\DockerData\backup.tar
wsl --unregister docker-desktop-data
wsl --import docker-desktop-data D:\DockerData \
    D:\DockerData\backup.tar
del D:\DockerData\backup.tar

All Docker data now lives on D:\. Your C:\ drive is protected.

Safety Summary

Quick Start: 9 Steps

1. Install Docker Desktop (~10 min)
2. Create project folder: mkdir -p ~/coding-agent-workshop
3. Create Dockerfile (copy from handout Part 9)
4. Create docker-compose.yml (copy from handout Part 5)
5. Build the image: docker buildx build -t coding-agent .
6. Start the container: docker compose up -d
7. Enter the container: docker exec -it my-agent bash
8. Authenticate your AI agent(s) (API key or subscription)
9. Start working: claude, codex, or gemini

See the handout for detailed instructions at each step.

Try It: Give the Agent a Task

docker exec -it my-agent bash
claude --verbose

Then type:

Write an R script that loads the mtcars dataset, runs a regression of mpg on wt and hp, and saves a nice ggplot to output/regression_plot.pdf

Watch it plan, write code, run it, see errors, fix them, and produce output.

Compare All Three Agents

# Claude Code
claude -p "Analyze mtcars: regression of mpg~wt+hp, save plot"

# OpenAI Codex
codex exec "Analyze mtcars: regression of mpg~wt+hp, save plot"

# Google Gemini CLI
gemini -p "Analyze mtcars: regression of mpg~wt+hp, save plot"

Check output/ on your host for results!

Cheat Sheet

docker compose up -d          # Start
docker exec -it my-agent bash # Enter
docker compose down           # Stop
docker ps                     # List
docker stats my-agent         # Monitor

claude                  # Claude Code
claude --model opus     # Opus model
codex                   # OpenAI Codex
gemini                  # Gemini CLI
R / Rscript script.R    # Run R
python3                 # Run Python

Summary

Resources