OneDev 17: Sandboxes for CI/CD and Workspaces

OneDev 17 introduces sandboxes for CI/CD jobs and development workspaces. It uses Docker Sandboxes to run each job or workspace in its own virtual machine on the OneDev server or an agent host.

Ordinary Docker containers on the same host share a kernel. Each sandbox has its own kernel, adding a VM boundary that helps protect the host and other sandboxes from build scripts, third-party dependencies, or coding agents running inside it.

Inside the VM, you can install tools and run services. Sandbox templates are Docker images, so you can also preinstall your toolchain using a Dockerfile.

With a Docker-enabled template, you can build images and use docker compose to run an application with its database and cache. The VM has its own Docker daemon and image storage, so there is no need to share the host's Docker socket or set up privileged Docker-in-Docker.

For CI/CD, OneDev starts each job in a fresh sandbox. Steps can run directly in the VM or in containers, alongside job services. Docker-enabled templates support OneDev's Docker steps and Compose-based integration tests.

In workspaces, developers can run coding agents, use development tools, and start a Compose stack directly from the terminal.

Sandbox hosts need hardware virtualization, or nested virtualization when running in a VM. Running sandboxes on agents requires Enterprise Edition.

See the Working with Sandbox tutorial for host setup, security settings, and template creation.