A 485,823-line runtime puts agent teams in YAML
Docker Agent turns an agent system into a declarative file: models, instructions, tools, sub-agents, retrieval sources, permissions, and runtime choices can live together in YAML. The measured checkout contained about 485,823 source lines across 2,459 files, so the simple configuration surface sits on a large Go codebase. That size buys more than chat. The runtime handles delegation, built-in reasoning tools, several model providers, MCP servers, retrieval strategies, a terminal interface, and OCI packaging for sharing an agent configuration.
The Docker integration is practical for teams already using its distribution model. An agent can run as a local YAML file or as an OCI reference pulled from a registry. Docker Desktop 4.63+ includes the CLI plugin, and Homebrew or release binaries cover other installations. The same agent can also be served as MCP tools to Claude Desktop, Claude Code, or another compatible client. This is most useful when the configuration itself needs version review and promotion between environments.
One working agent still needs a model and a safety policy
The README's smallest example is short, but it still names a model and an MCP toolset. A cloud route needs the provider's credential, such as an OpenAI, Anthropic, or Google key. Docker Model Runner provides a local path after a model is downloaded, while custom OpenAI-compatible endpoints can point at an existing gateway. The setup guide also documents a Claude Code harness that uses the authenticated CLI from a subscription instead of a provider API key.
Permissions deserve equal attention. Docker Agent has 4 named safety modes: strict, balanced, restricted, and autonomous. Restricted denies destructive or unknown calls that lack an explicit rule, while autonomous allows them. The documentation warns that an agent author can place a default in YAML, including autonomous mode, although user-owned flags and settings take priority. Treat any registry reference as executable policy. Pin it, inspect its tools and safety defaults, then set a user-controlled mode before the first run.
What happened when we ran it
Our sandbox installed Docker Agent in 78 seconds, adding 370 packages in an unprivileged golang:1.24-bookworm container with 3 CPUs and 8 GB of RAM. The source build completed successfully in 213 seconds. The 49.7 MB checkout included 10 CI workflow files and a Dockerfile. It had no top-level tests directory, although the Go test command discovered and ran package tests throughout the repository.
The full test step ran for 529 seconds and exited with code 1. Go reported 267 passed and 4 failed out of 271. The supplied tail lists successful packages under the terminal UI, upstream, user configuration, identity, and worktree areas, then ends with FAIL. It does not show the names or error messages for the 4 failed tests. We can say the suite was not green at commit b407a13; the available evidence cannot support a cause.
A 30-second RAG timeout can turn into provider pressure
Docker Agent supports BM25, chunked embeddings, semantic embeddings, hybrid fusion, and reranking. Semantic embeddings are the expensive path because an LLM summarizes chunks before they are embedded. Open issue 4060 describes a failure pattern around a hardcoded 30-second toolset start timeout: unfinished indexing restarts on later agent loop iterations, repeats work for a file, and can run into provider rate limits. The report is detailed enough that teams planning a large knowledge base should test cold indexing before connecting production credentials.
Issue 4067 narrows a related case in code mode. When some toolsets start and another receives a retryable error, the healthy subset remains available, but the degraded subset can be retried without the intended rate-limit backoff. Both reports were active on August 27, 2026. A cautious deployment can begin with BM25 or ordinary chunked embeddings, cap provider budgets, and watch debug logs during a representative initial index. The current docs also say semantic indexing adds an LLM call per chunk and extra API cost.
MCP HTTP has safe defaults, while telemetry starts enabled
MCP mode uses stdio by default. Its HTTP option listens on 127.0.0.1:8081, and a non-loopback address requires a bearer token unless the operator explicitly selects insecure operation. HTTP sessions default to restricted safety after command-line and agent configuration are considered. Those defaults are sensible, but exposing an agent still means protecting its model credentials, working directory, allowed tools, and registry source. An authenticated endpoint can still perform harmful work if its tool policy is too broad.
Anonymous usage telemetry is enabled by default and can be disabled with TELEMETRY_ENABLED=false. The documented events include command names and outcomes, agent and model names, tool calls, token totals, estimated costs, session durations, and error counts. Docker says prompts, responses, files, keys, and personal information are excluded. Organizations with strict outbound-data rules should set the opt-out centrally and verify it rather than relying on each developer to remember an environment variable.
v1.127.0 is active, but the 529-second test failure matters
GitHub recorded a push on August 27, 2026, and release v1.127.0 was published on August 21. That release added PAC-aware egress with SSRF protections and fixed toolset startup from blocking a conversation turn. GitHub showed 3,292 stars and 52 combined open issues and pull requests when fetched. New issues and same-day closed work on August 27 show active maintenance; the combined open count should not be read as 52 confirmed bugs.
Docker Agent earns a serious trial when a team needs one packaged layer for YAML agents, MCP, multiple providers, retrieval, and Docker distribution. Our 370-package install and 213-second build show that this convenience carries real code and dependency weight. The 4 failed tests prevent a blanket recommendation for the measured commit, especially when the log tail cannot explain them. Run the full suite in your own environment, start with restricted permissions, turn off telemetry if policy requires it, and test RAG indexing against a capped provider account before wider use.