Developer shares hardened Docker sandbox config with gVisor for securing MCP servers

A developer has published a detailed Docker sandbox configuration designed to securely isolate MCP servers, responding to community feedback on their earlier article about Docker sandboxing. The setup combines multiple security layers including a read-only root filesystem, dropped Linux capabilities, non-root user execution, memory and PID limits, and a tmpfs mount for temporary files. The most significant addition is gVisor's runsc runtime, which intercepts all system calls in userspace, preventing the containerized process from directly accessing the host kernel. This approach blocks dangerous syscalls such as ptrace, bpf, mount, and kexec_load, and has reportedly been applied to audit 8,764 MCP servers. The team noted that egress proxy support with an allowlist for servers requiring outbound network access is planned as a future update.