Docker’s Survey Pitch Turns Developer Caution Into a Sandbox Case, but Security Ranks Eighth Among the AI Mistakes That Cost Time

Docker’s October 16 post on the 2026 Stack Overflow Developer Survey reaches a clear verdict: “Put it all together, and the missing ingredient is clear: trust.” The evidence it offers is a handful of survey figures, led by “Only 7% of developers trust AI output for important work decisions.” Every one of those figures matches the survey’s published tables.

Stack Overflow also publishes the raw responses, so I recomputed each figure from the 30,903-row public file. The numbers hold. What changes is what they mean. The 7% is a share of AI users, and it is 11.8% among people who say they use agents. The “one in four” who lost time to security or privacy issues is the eighth most common of ten answers, far behind plausible but wrong code (69.3%) and hard-to-review generated code (54.2%). And the survey never asks about sandboxes.

None of this argues against sandboxes. The same file shows that the most common check developers make on an AI answer is to run it locally (76.5%), and that the developers who trust AI most use its answers as-is a third of the time. It argues for reading a vendor’s survey post against the survey. The script that recomputes every number below is at the end.

What Docker’s post argues

The post, bylined Terri Avnaim, opens with a keynote by Docker president Mark Cavage at WeAreDevelopers World Congress North America and then turns to the survey. It says that “Docker is the most used (59%) and most desired (38%) tool in the survey’s cloud development category.” It lists three findings: 7% trust AI output for important work decisions, with 48% trusting it “only when they can verify it themselves”; security and privacy rank second among adoption factors; and “nearly one in four” developers lost team time to AI-related security or privacy issues. It closes by tying them to Docker Cloud Sandboxes, the Sandbox Kit specification that Docker has committed to submitting to the Cloud Native Computing Foundation, and “helping developers manufacture trust for AI agents.” A $250 credit for signups before October 31 follows.

The post is candid about its genre. Explaining why it cites Docker’s own usage numbers, the author writes: “I didn’t point out those earlier Docker numbers just to brag (though, hey, I’m a marketer, so it was at least part of it).” None of that makes the numbers wrong. We covered the Sandbox Kit specification and its handoff to CNCF and Docker’s YOLO-mode explainer earlier. The question here is narrower: what can each survey figure bear?

How each figure holds up

The table lists each survey claim in the post, what the survey records and the base it rests on. Counts and percentages match the survey’s AI, technology and knowledge data pages. The shares of all valid responses are mine.

The 7% is a share of AI users, and it is 11.8% for people who run agents

The trust question, “How much do you trust the output from AI tools or AI agents as part of your workflow?”, is a single choice among six answers. All 14,304 people who answered it had also answered the AI-use question, and only 6 of them said they do not use AI tools. So 6.6% is a share of AI users. Across all 30,903 valid responses the same 949 people would be 3.1%, but that base includes people who never answered the AI questions. Stack Overflow’s own chart summary says “only 7% trust it with important decisions.” Docker repeats that framing.

The figure also moves with who is answering. It rises with experience, from 4.5% (146 of 3,259) at one to five years, to 6.2% (309 of 4,950) at six to fifteen years and 8.3% (460 of 5,512) at sixteen or more. And it is far higher among the people Docker’s sandboxes are meant for. Of the 4,582 respondents who said they use “AI agents or automated workflows” at work, 4,499 answered the trust question, and 11.8% of them (529) trust AI for important decisions. Everyone else in the trust sample is at 4.3% (420 of 9,805).

That is an association, not a cause. People who already trust AI may be the ones who hand it agent work, and “automated workflows” also covers plain automation tools. Still, it changes the impression the headline gives: the 7% understates trust among the people running agents.

The 48% is the most common answer, not an “only”

Docker writes that nearly half “trust it only when they can verify it themselves.” The survey option is “I trust it when I can easily verify the output”, chosen by 6,872 of 14,304 respondents (48.0%). It is one answer among six. Two others, each chosen by 16.3%, set limits by task: “low-risk work tasks only” and “many tasks, but not important work decisions”. Because the question allows one choice, 48.0% is the share for whom easy verification was the best description. It does not show that everyone else skips verification, and it does not show that checking the output yourself is the only route to trust.

The 59% leads a mixed list, and last year’s same question gave 71.1%

Docker’s 59% and 38% are exact: 6,440 of the 10,889 respondents who answered the cloud development question have worked extensively with “Docker / Docker Compose”, and 4,177 want to. The chart is titled Cloud development, but the question behind it covers “cloud platforms, containerization/orchestration tools, package managers, build tools, and infrastructure as code solutions.” npm is second at 54.6% (5,945).

Docker’s lead over the runner-up is also narrower than it was. On a nearly identical question in the 2025 survey, 17,394 of 24,473 respondents (71.1%) named Docker and 13,891 (56.8%) named npm, a 14.3-point lead against 4.5 points now. That comparison needs care. The 2025 survey itself said Docker’s 17-point jump that year was “partially due to consolidating some technology sectors,” the 2025 chart lists 42 answers against 56 named options now, and the pool of respondents changed. I would not read 71.1% to 59.1% as usage falling. The post’s “confirmed yet again” simply leaves the prior-year number out.

Security ranks second as an adoption factor, by narrow margins

The question asks which factors matter most when deciding whether to adopt, continue using or expand an AI tool, and lets people pick up to three. Accurate results were named by 3,520 of 11,462 respondents (30.7%), security and privacy requirements by 3,290 (28.7%) and acceptable price by 3,090 (27.0%). Docker’s ordering is right, but the margins are 2.0 and 1.7 points, and 22.0% answered “Not sure”. Among agent users accuracy leads by more: 35.1% against 30.3% for security and privacy (3,318 respondents). People who run agents name correct output more often than safe output.

The “one in four” is eighth of ten

The question reads “What kinds of AI mistakes have cost you or your team the most time in the past year? Select all that apply.” Respondents picked 3.59 answers on average. Docker’s “nearly one in four” is the 23.5% (3,205 of 13,648) who picked “Security/privacy issue”, which ranks eighth of the ten answers. Plausible but wrong code was named by 69.3%, hard-to-review generated code by 54.2%, missing context by 49.3% and hallucinated package or config by 45.1%. Altogether 82.1% (11,200) named wrong code, hard-to-review code or both.

Security is also not a separate crowd. Of the 3,205 who named it, 2,645 (82.5%) also named plausible but wrong code, and only 69 (2.2%) named nothing else. Agent users named it more often than other AI users, 24.7% (912 of 3,688) against 20.5% (1,592 of 7,766), which supports Docker’s focus modestly. The survey does not say what kind of security or privacy issue cost the time. A leaked secret, an unsafe suggestion, data sent to a vendor and a compliance review all fit the answer.

What the time went to, and what isolation touches

The survey measures time lost, not harm done, and the two can differ: one leaked credential can cost more than a hundred wrong suggestions. Within that limit, the list shows what developers say they lose time to. The right-hand column is my reading of whether a sandbox, meaning an isolated environment that limits what an agent can touch, addresses each item. It is not survey data.

On this reading, isolation addresses one of the nine named mistakes directly and one partly. The rest turn on whether the output is right and whether a person can review it in reasonable time, which is the territory of tests, review practice and context. A Harvard study of 718 firms that we covered earlier put a number on that last queue: the time between opening a pull request and merging it rose 49 percent on the paper’s point estimate after firms adopted AI coding agents. For the review side of the problem, our tutorial on reviewing AI-generated Python code walks through a repeatable workflow.

Where the raw data backs Docker’s direction

Four results from the same file support the case for isolation, and Docker’s post cites none of them.

• Developers run AI output on their own machines. Asked what they usually do before using an AI-generated answer, 76.5% (10,067 of 13,162) said they run it locally, the most common step. Only 9.6% use answers as-is. The survey does not say where “locally” is, but that first execution is a natural place for isolation.
• The most trusting developers check the least. Among those who trust AI for important decisions, 33.6% (297 of 884) use answers as-is, against 6.3% (400 of 6,315) of those who trust it when they can verify the output.
• Production changes are already being delegated. In the last 30 days, 18.9% of those who answered (2,601 of 13,756) delegated “changing production code, systems, or infrastructure” to an AI tool or agent. Among agent users the figure is 39.4% (1,383 of 3,514).
• Some tools choose their own inputs. Asked how much control they have over the work information AI tools use, 14.7% of agent users (511 of 3,467) said “the AI tool chooses the information automatically”, against 10.4% of everyone who answered (1,374 of 13,243).

Docker’s installed base also sits where the agents are. Among agent users who answered the cloud development question, 67.4% (2,124 of 3,152) have worked extensively with Docker or Docker Compose, against 59.1% of all respondents. Taken together, the data describes a mostly cautious population with two groups where the exposure is higher: the trusting minority, who use answers unchecked far more often, and agent users, two in five of whom delegated production changes in the last 30 days. A sandbox is a control aimed at those groups. The survey does not test whether it works.

What the survey cannot show

I searched the question text in the survey’s data schema for sandbox, isolation, permission, container, least privilege, approval, autonomy, guardrail, credential and secret. The only questions that matched were the cloud development list, which asks about containerization tools, a question about “security and permissions-based tools”, and an AI tool-count question that mentions autonomous agents. The security question lists 26 vendors, from Aqua Security to Wiz, and none of them is a sandbox. Its agentic-workflows column was answered by 531 respondents, led by Auth0 (172), Datadog (125) and Okta (98). So the survey cannot say whether developers who use sandboxes trust agents more, lose less time or have fewer incidents.

The sample has limits too. The methodology page says “The survey was promoted through stackoverflow.com, stackoverflow.blog and our email list to community members that are opted into learning about research opportunities or announcements.” Of the 14,347 people who rated the survey’s length, 65.5% called it too long. The AI questions were optional, the AI-use question was answered by 17,464 of the 30,903 valid responses (56.5%), and a response counts as valid without finishing the AI section. Everything is self-reported at one point in time, so every comparison above is an association.

What a team can take from it

1. Match each control to the cost it targets. If your team’s lost time looks like the survey’s, with wrong code and review burden on top, the first spend is tests and review capacity. Isolation is for the blast radius when a command or a package goes wrong.
2. Treat “run it locally” as a decision. The most common check on AI-written code is to execute it, and on a developer machine that runs with the developer’s credentials and network unless someone chose otherwise. Run it in an environment whose reach you set on purpose. A container, a microVM or a sandbox product can all do that.
3. Weigh isolation against context. A boundary narrows what an agent can read, and missing context is the third most common cost (49.3%). Decide what goes inside the boundary deliberately, especially since 14.7% of agent users say their tool picks its own inputs.
4. Ask your own team the survey’s question. “What kinds of AI mistakes have cost you or your team the most time?” works as a retrospective prompt. If security comes first on your list, the sandbox case is stronger than it looks in this data. If wrong code comes first, it is weaker.

Recompute it yourself

The public file is released under the Open Database License 1.0, which asks for attribution: Stack Exchange Inc. (2026), Stack Overflow Developer Survey 2026. It sits in the survey’s GitHub repository under Git LFS, so the usual raw.githubusercontent.com address returns only a 134-byte pointer. Download it from media.githubusercontent.com instead. The script uses only the Python standard library and ran on Python 3.13.14 for Windows. The question definitions are in the repository’s 2026 question bank, and the 2025 figures above come from its 2025 technology.json.

curl -L -o survey_results_public.csv https://media.githubusercontent.com/media/StackExchange/Survey/main/packages/archive/2026/survey_results_public.csv
python survey_audit.py survey_results_public.csv

# survey_audit.py
"""Recompute the Stack Overflow Developer Survey 2026 figures that Docker's post cites.
Usage: python survey_audit.py survey_results_public.csv"""
import csv
import sys
from collections import Counter

csv.field_size_limit(10**7)
with open(sys.argv[1], encoding="utf-8-sig", newline="") as f:
    rows = list(csv.DictReader(f))


def has(r, col, option):  # multi-select cells are semicolon-joined
    return option in [x.strip() for x in r[col].split(";")]


def n_has(rs, col, option):
    return sum(has(r, col, option) for r in rs)


def n_eq(rs, col, value):
    return sum(r[col] == value for r in rs)


def answered(col, rs=None):
    return [r for r in (rows if rs is None else rs) if r[col] not in ("", "NA")]


def show(label, k, n):
    print(f"{label:<64}{k:>6} /{n:>6} = {100 * k / n:5.1f}%")


print(f"rows in the public file: {len(rows):,}")
agents = {r["ResponseId"] for r in rows if has(r, "AISelect", "AI agents or automated workflows")}
others = {r["ResponseId"] for r in answered("AISelect")
          if not r["AISelect"].startswith("I don") and r["ResponseId"] not in agents}

show("answered the AI-use question (AISelect)", len(answered("AISelect")), len(rows))
show("  of them, use AI agents or automated workflows", len(agents), len(answered("AISelect")))

print("\n## Trust (AITrust, single select)")
top = "I trust it for many tasks, including important work decisions"
ver = "I trust it when I can easily verify the output"
trust = answered("AITrust")
show("important decisions", n_eq(trust, "AITrust", top), len(trust))
show("  same count over all valid responses", n_eq(trust, "AITrust", top), len(rows))
show("when I can easily verify the output", n_eq(trust, "AITrust", ver), len(trust))
show("  trust respondents who answered the AI-use question", len(answered("AISelect", trust)), len(trust))
show("  trust respondents who said they do not use AI tools",
     sum(r["AISelect"].startswith("I don") for r in trust), len(trust))
ag = [r for r in trust if r["ResponseId"] in agents]
rest = [r for r in trust if r["ResponseId"] not in agents]
show("  agent users: important decisions", n_eq(ag, "AITrust", top), len(ag))
show("  everyone else: important decisions", n_eq(rest, "AITrust", top), len(rest))


def years(r):
    try:
        return int(float(r["WorkExp"]))
    except ValueError:
        return None


for lo, hi, name in ((1, 5, "1-5"), (6, 15, "6-15"), (16, 10**6, "16+")):
    g = [r for r in trust if years(r) is not None and lo <= years(r) <= hi]
    show(f"  {name} years of experience: important decisions", n_eq(g, "AITrust", top), len(g))

print("\n## AI mistakes that cost the most time (Disruption, select all)")
dis = answered("Disruption")
counts = Counter(x.strip() for r in dis for x in r["Disruption"].split(";"))
sec = "Security/privacy issue"
wrong, hard = "Plausible but wrong code", "Hard-to-review generated code"
rank = [name for name, _ in counts.most_common()].index(sec) + 1
show(f"security/privacy issue (rank {rank} of {len(counts)})", counts[sec], len(dis))
show("plausible but wrong code", counts[wrong], len(dis))
show("hard-to-review generated code", counts[hard], len(dis))
either = sum(has(r, "Disruption", wrong) or has(r, "Disruption", hard) for r in dis)
show("wrong code or hard-to-review code", either, len(dis))
print(f"answers picked per respondent: {sum(counts.values()) / len(dis):.2f}")
s = [r for r in dis if has(r, "Disruption", sec)]
show("  security/privacy selectors who also chose wrong code", n_has(s, "Disruption", wrong), len(s))
show("  security/privacy selectors who chose nothing else", n_eq(s, "Disruption", sec), len(s))
da = [r for r in dis if r["ResponseId"] in agents]
do = [r for r in dis if r["ResponseId"] in others]
show("  agent users: security/privacy issue", n_has(da, "Disruption", sec), len(da))
show("  other AI users: security/privacy issue", n_has(do, "Disruption", sec), len(do))

print("\n## Docker in the cloud development list (CloudPlat)")
cloud = [r for r in rows
         if r["CloudPlatHaveWorkedWith"] not in ("", "NA") or r["CloudPlatWantToWorkWith"] not in ("", "NA")]
dk = "Docker / Docker Compose"
show("Docker / Docker Compose, worked with", n_has(cloud, "CloudPlatHaveWorkedWith", dk), len(cloud))
show("Docker / Docker Compose, want to work with", n_has(cloud, "CloudPlatWantToWorkWith", dk), len(cloud))
show("npm, worked with", n_has(cloud, "CloudPlatHaveWorkedWith", "npm"), len(cloud))
ca = [r for r in cloud if r["ResponseId"] in agents]
show("  agent users: Docker / Docker Compose, worked with", n_has(ca, "CloudPlatHaveWorkedWith", dk), len(ca))

print("\n## Factors in AI adoption (AIAdopt, select up to 3)")
adopt = answered("AIAdopt")
acc = "The tool produces useful and accurate results"
sp = "The tool meets security, privacy requirements"
price = "The price is acceptable for the value it provides"
for label, opt in (("accurate results", acc), ("security and privacy requirements", sp),
                   ("acceptable price", price)):
    show(label, n_has(adopt, "AIAdopt", opt), len(adopt))
aa = [r for r in adopt if r["ResponseId"] in agents]
show("  agent users: accurate results", n_has(aa, "AIAdopt", acc), len(aa))
show("  agent users: security and privacy requirements", n_has(aa, "AIAdopt", sp), len(aa))

print("\n## What people delegate, control and do with answers")
prod = "Changing production code, systems, or infrastructure"
deleg = answered("KnowAgentDelegate")
dg = [r for r in deleg if r["ResponseId"] in agents]
show("delegated production changes in the last 30 days", n_has(deleg, "KnowAgentDelegate", prod), len(deleg))
show("  agent users", n_has(dg, "KnowAgentDelegate", prod), len(dg))
auto = "The AI tool chooses the information automatically"
ctl = answered("KnowAgentTrust")
ka = [r for r in ctl if r["ResponseId"] in agents]
show("tool chooses its own information: everyone who answered", n_eq(ctl, "KnowAgentTrust", auto), len(ctl))
show("  agent users", n_eq(ka, "KnowAgentTrust", auto), len(ka))
nxt = answered("AIWorkNext")
show("run it locally before using an AI answer", n_has(nxt, "AIWorkNext", "Run it locally"), len(nxt))
show("use an AI answer as-is", n_has(nxt, "AIWorkNext", "Use as-is"), len(nxt))
hi_trust = [r for r in nxt if r["AITrust"] == top]
verifiers = [r for r in nxt if r["AITrust"] == ver]
show("  as-is, among those who trust AI for important decisions",
     n_has(hi_trust, "AIWorkNext", "Use as-is"), len(hi_trust))
show("  as-is, among those who trust AI when they can verify it",
     n_has(verifiers, "AIWorkNext", "Use as-is"), len(verifiers))

print("\n## Security vendors used in agentic workflows (SecOps)")
sa = answered("SecOpsUsedInAgenticWorkflows")
named = Counter(x.strip() for r in sa for x in r["SecOpsUsedInAgenticWorkflows"].split(";"))
print(f"{len(sa)} respondents named at least one; top three: {named.most_common(3)}")

It prints:

rows in the public file: 30,903
answered the AI-use question (AISelect)                          17464 / 30903 =  56.5%
  of them, use AI agents or automated workflows                   4582 / 17464 =  26.2%

## Trust (AITrust, single select)
important decisions                                                949 / 14304 =   6.6%
  same count over all valid responses                              949 / 30903 =   3.1%
when I can easily verify the output                               6872 / 14304 =  48.0%
  trust respondents who answered the AI-use question             14304 / 14304 = 100.0%
  trust respondents who said they do not use AI tools                6 / 14304 =   0.0%
  agent users: important decisions                                 529 /  4499 =  11.8%
  everyone else: important decisions                               420 /  9805 =   4.3%
  1-5 years of experience: important decisions                     146 /  3259 =   4.5%
  6-15 years of experience: important decisions                    309 /  4950 =   6.2%
  16+ years of experience: important decisions                     460 /  5512 =   8.3%

## AI mistakes that cost the most time (Disruption, select all)
security/privacy issue (rank 8 of 10)                             3205 / 13648 =  23.5%
plausible but wrong code                                          9452 / 13648 =  69.3%
hard-to-review generated code                                     7403 / 13648 =  54.2%
wrong code or hard-to-review code                                11200 / 13648 =  82.1%
answers picked per respondent: 3.59
  security/privacy selectors who also chose wrong code            2645 /  3205 =  82.5%
  security/privacy selectors who chose nothing else                 69 /  3205 =   2.2%
  agent users: security/privacy issue                              912 /  3688 =  24.7%
  other AI users: security/privacy issue                          1592 /  7766 =  20.5%

## Docker in the cloud development list (CloudPlat)
Docker / Docker Compose, worked with                              6440 / 10889 =  59.1%
Docker / Docker Compose, want to work with                        4177 / 10889 =  38.4%
npm, worked with                                                  5945 / 10889 =  54.6%
  agent users: Docker / Docker Compose, worked with               2124 /  3152 =  67.4%

## Factors in AI adoption (AIAdopt, select up to 3)
accurate results                                                  3520 / 11462 =  30.7%
security and privacy requirements                                 3290 / 11462 =  28.7%
acceptable price                                                  3090 / 11462 =  27.0%
  agent users: accurate results                                   1164 /  3318 =  35.1%
  agent users: security and privacy requirements                  1006 /  3318 =  30.3%

## What people delegate, control and do with answers
delegated production changes in the last 30 days                  2601 / 13756 =  18.9%
  agent users                                                     1383 /  3514 =  39.4%
tool chooses its own information: everyone who answered           1374 / 13243 =  10.4%
  agent users                                                      511 /  3467 =  14.7%
run it locally before using an AI answer                         10067 / 13162 =  76.5%
use an AI answer as-is                                            1265 / 13162 =   9.6%
  as-is, among those who trust AI for important decisions          297 /   884 =  33.6%
  as-is, among those who trust AI when they can verify it          400 /  6315 =   6.3%

## Security vendors used in agentic workflows (SecOps)
531 respondents named at least one; top three: [('Auth0', 172), ('Datadog', 125), ('Okta', 98)]

Docker’s sandbox argument may well be right. The survey just does not test it. What it does show is that the AI mistakes developers most often name as costing them time are wrong and hard-to-review output, which a sandbox does not touch, and that their trust depends on how cheaply an answer can be verified. That is my reading, and your own team’s answer to the survey’s question is a better test of it than any outside survey.