Explore Labs
Bring Your Own Sandbox (BYOS)

Standalone Isolation.
Optimized for Mac & Windows.

Bring Your Own Sandbox (BYOS) is our flagship engine for Windows and macOS. Leverage a native hypervisor-isolated MicroVM to run labs without requiring Docker Desktop or a local Docker Engine installation.

One-Command Setup

Install the SBX CLI via Homebrew and initialize your environment in seconds with a single command.

Native OS Support

Deep integration with Windows Hyper-V and macOS Virtualization.Framework for native hardware performance.

Perfect Isolation

Every lab runs in a fresh, isolated MicroVM. No impact on your local system or other running applications.

1

Install SBX CLI

The gateway to your isolated sandbox.

macOS (via Homebrew)

Command
brew install docker/tap/sbx

Best for Mac users. Run this in your terminal to install the official SBX binary via Homebrew.

Windows (via winget)

Command
winget install Docker.sbx

Native Windows support. Run this in PowerShell or Command Prompt (requires winget).

Windows users can also use WSL2. In that case, run the Homebrew command within your Linux distribution.

2

Authentication

Authorize your local agent with Docker Hub.

sbx login

The sbx tool uses your Docker Hub account for authentication. Run the login command, visit the provided activation URL, and enter your one-time code to authorize your local agent.

sbx login

Need a Docker Account?

Create one for free →
$ sbx login
Visit: https://login.docker.com/activate?user_code=DCHG-BMSK
Waiting for authentication...
✓ Signed in as your-username
3

Launch & Configure

Start the runner and set security policies.

Terminal Command

Copy and paste the command below into your terminal. This will spin up an isolated lab runner container that establishes a secure tunnel to DockerHOL.

sbx run --image varshneysarthak/lab-runner:latest \ -e SESSION_TOKEN="..." \ -e API_URL="https://dockerhol.com/api" \ -e SESSION_ID="..." \ -e MODULE_ID="..." \ --privileged
Privileged Mode: Ensures the runner can interact with the native hypervisor.
Secure Tunnel: Bi-directional sync is established via your session token.
Interactive Configuration

Set Network Policy

Upon first launch, the sbx runner will prompt you to select a network policy. This ensures your local environment stays secure while allowing lab traffic.

  • 1
    OpenFull bi-directional traffic (Recommended).
  • 2
    BalancedStandard filtering for sensitive environments.
Interactive Terminal Selection
❯ 1. Open- RECOMMENDED
2. Balanced
3. Locked Down

* This prompt only appears during the first session initialization.

Ready to start the lab?Browse Labs