Dory: Docker, Kubernetes and agent sandboxes on Mac
Dory
A Docker Desktop replacement for Apple Silicon Macs with a built-in MCP server for AI agent sandboxes
- 1,633 ★ on the repository
- Last commit
- GPL-3.0
Broad access
Why this level
- In full mode an agent runs commands inside machines and creates sandboxes, and with full network access it reaches the internet
- A sandbox can be granted host secrets and the SSH agent, which then sit in the environment where the agent works
- The app installs a network helper, a daemon and virtual machines on the system and keeps container data on the chosen drive
Install
- Works in
Manual install
brew install --cask Augani/dory/doryInstalls Docker Core. Open the app once: docker, `docker compose` and dory appear in ~/.dory/bin.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- In full mode an agent runs commands inside machines and creates sandboxes, and with full network access it reaches the internet
- A sandbox can be granted host secrets and the SSH agent, which then sit in the environment where the agent works
- The app installs a network helper, a daemon and virtual machines on the system and keeps container data on the chosen drive
This is third-party code. Review the repository files before installing.
What it does
Dory is a macOS app for Apple Silicon that replaces Docker Desktop: a Docker engine with Compose and Buildx, k3s for Kubernetes and separate Linux machines (Ubuntu 24.04 with GNOME, Debian 13, Kali Linux, a light headless Alpine). After the first launch the docker, `docker compose` and dory commands appear, so a separate Docker CLI is not needed. Agents use the `dory mcp serve` command. It is an MCP server over stdio with 19 tools: diagnostics, machine operations, waiting for a state, an event stream and the full sandbox lifecycle from creation to shutdown. With the `--read-only` flag the agent can only observe. An agent sandbox is a separate headless virtual machine. Host files do not enter it by default, processes run as non-root and mounted folders are read-only. Network policy has three modes: closed, an allowlist of addresses or full access. Secrets and the SSH agent are granted for the session only, and there are rollback, a kill switch and TTL cleanup.
Who it is for. For Mac developers on Apple silicon who want to run containers and give Claude Code, Cursor or Codex an isolated place for commands and tests.
Good fit when
- An agent runs builds and tests and you want them in a sandbox with a closed network and rollback, apart from your own machine
- You need a Docker Desktop replacement on Mac that imports images, volumes and containers from Docker Desktop, OrbStack, Colima, Rancher Desktop or Podman
- A project needs containers, local Kubernetes on k3s and a Linux machine next to it in one program
- You want a real Linux environment with its own disk and snapshots, such as Ubuntu with a desktop or Kali
Not a fit when
- A Windows or Linux computer, or an Intel Mac
- You need a license that allows closed-source use: Dory ships under GPL-3.0
- One container for yourself is enough: plain `docker run` is simpler than a separate environment with virtual machines
- You want an MCP server for the Docker engine itself with images and volumes: the Dory tools cover machines and sandboxes and skip individual Docker objects
Example request
Create a Dory sandbox for this project with the network closed, run the tests inside it and show me the result without touching files on the hostMCP
- Transport
- stdio
- Authentication
- not required
Limitations
- It runs only on Apple Silicon Macs with macOS 14 or newer. Intel Mac builds and Homebrew cask are not published; support is promised after validation on that hardware.
- The base install contains Docker Core only. Kubernetes, Linux machines, the graphical runtime, Debian, Ubuntu and Kali are separate signed components, and Dory shows their size and waits for confirmation before downloading.
- The license is GPL-3.0.
How to disable. Remove the `dory mcp serve` entry from your MCP client settings. The app itself is uninstalled like any macOS program; the selected data drive stays, and optional components can be removed one by one without touching containers or volumes.
FAQ
How do I connect Dory to Claude Code or Cursor?
In the MCP settings, set the command to dory and the arguments to mcp serve plus the read-only flag. The first app launch puts dory into ~/.dory/bin; add that folder to PATH if your client cannot see it.
What can an agent do in read-only mode?
It reads the dory.agent_guide manual, runs diagnostics, checks engine status and the machine list, waits for a state and receives the event stream. Command execution in machines and every sandbox write are blocked in this mode.
How is a Dory sandbox different from a plain container?
A sandbox is a separate headless virtual machine with its own access policy: files, network and secrets are granted to it explicitly. The reset command returns it to the prepared baseline.
How do I migrate containers from Docker Desktop or OrbStack?
Dory has a transactional import from Docker Desktop, OrbStack, Colima, Rancher Desktop, Podman and any other Docker-compatible socket. You can move everything or pick items, and the app ends with a report of what was moved, verified and skipped.
How do I install Dory?
With Homebrew: `brew install --cask Augani/dory/dory`, or download the DMG from the releases page. The install contains Docker Core; the other components are added from inside the app.
Discussion
No questions or reviews yet.
Related
MCP serversMCP server for managing Docker in natural language: containers, images, networks and volumes, including remote hosts over SSH
Container by Aerovato
Container
A CLI for persistent per-project Linux workspaces in Docker or Podman that keep the agent away from the rest of your system
A secure MCP runtime through which an agent operates local machines, servers and containers
Containarium: isolated boxes for AI agents
Containarium
A platform on your own server that gives each agent its own Linux box with SSH and MCP tools for commands and files
Docker MCP by QuantGeekDev
docker-mcp
Docker MCP: an agent creates containers, deploys Docker Compose stacks from YAML, reads logs and lists containers. Runs through uvx for Claude Desktop
The docker mcp CLI plugin and gateway: MCP servers from Docker's catalog in isolated containers behind one connection point
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Dory: Docker, Kubernetes and agent sandboxes on Mac (this entry) | yes | not required | 1,633 | |
| container-use | yes | not required | 4,079 | Dagger gives each agent a container and a Git branch, while Dory offers a virtual machine and a full Docker environment |
| AIO Sandbox | no | key is optional | 6,247 | a single container bundling a browser, terminal and MCP services, without Kubernetes or Linux machines |
| CodeRunner | yes | not required | 898 | a local sandbox that runs code in a container over MCP, without its own Docker environment |
README in short
A feature table covers nine areas, from Docker and Kubernetes to migration and agents. Repair touches only the named layer, and cleanup runs as a dry run by default, changing data only with the `--apply` flag.