Answer
Should MCP servers run in Docker?
A local MCP server should run in a sandbox that limits its files, network and credentials. Docker is the common choice because it is available and understood; a microVM or a dedicated sandbox service can do the same job.
Why not run it on the host?
A local server runs as you. If it is compromised, it has your home directory, your network and every token in your environment. The OWASP MCP guidance names sandbox escapes and full host access as the route to file traversal, credential theft and arbitrary code execution.
What does the episode say?
At 15:45 Manoj Nair describes the common enterprise setup: skills scanning and MCP scanning, "a secure sandbox, you know, Docker or something else", and separate identities for the agents. The sandbox is one of three controls, not a substitute for the other two.
What does a good sandbox look like?
- A read-only root and one mounted directory, the one the task needs.
- No host network, and an egress allowlist if the task needs the network at all.
- A non-root user inside the container.
- A recorded image digest, so the environment itself is pinned.
- No credential in the container that the task does not need.
How does the checker know?
It reads the sandbox field and the launch arguments. A missing sandbox is SC-07. A container with host networking or a root mount is a critical form of the same rule. The checker cannot prove the container is configured as declared; it reports the declaration and says so.
Source note. The sandbox guidance comes from the episode at 15:45, the OWASP MCP Security Cheat Sheet and the MCP security best practices page. All sources.