Set Up Your Docker Sandbox Environment

Objective

Create a docker-compose.yml file that sets up a complete Computer Use development environment with proper isolation, networking, and volume mounts.

Background

Running Computer Use agents directly on your system is risky. Docker provides isolation so the agent can't accidentally delete files or access sensitive data on your host machine.

Requirements

Create a docker-compose.yml file that:

1. Uses the official Anthropic image: ghcr.io/anthropics/anthropic-quickstarts:computer-use-demo-latest

2. Exposes required ports:

   • 5900 for VNC
   • 6080 for noVNC (browser-based viewing)
   • 8501 for Streamlit interface

3. Sets environment variables:

   • ANTHROPIC_API_KEY from host environment
   • WIDTH=1024 and HEIGHT=768 for screen resolution

4. Configures security:

   • --cap-drop=ALL to remove unnecessary capabilities
   • Read-only root filesystem where possible
   • No privileged mode

5. Sets up volume mounts:

   • A ./workspace folder mounted to /home/user/workspace for file sharing
   • This is the ONLY writable location the agent should access

6. Network isolation (optional challenge):

   • Create a custom network with limited external access

Expected Output Structure

version: '3.8'
services:
  computer-use:
    image: ghcr.io/anthropics/anthropic-quickstarts:computer-use-demo-latest
    ports:
      - "5900:5900"
      - "6080:6080"
      - "8501:8501"
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - WIDTH=1024
      - HEIGHT=768
    # ... security and volume configuration

Hints

• Use ${VARIABLE} syntax to reference host environment variables
• The cap_drop directive removes Linux capabilities
• Mount volumes with :rw for read-write or :ro for read-only