AgentOS vs Docker Agent

AgentOS

A TypeScript agent framework with typed tools, six multi-agent strategies, checkpointed graphs, approval gates and no telemetry of its own. It is at 0.12.12 after 98 releases in 90 days, two of them breaking on 7 October 2026. No MCP client was found in the package, and code tools an agent writes run in an in-process node:vm context.

Docker Agent

An agent with an MCP server is eight lines of YAML, and the same file runs in a terminal, headless, or as an HTTP, MCP or A2A server. Usage telemetry is on by default and can carry prompts passed as command arguments, and two high-severity approval bypasses were fixed in August and September 2026.

AgentOS

1. Pin an exact version of @framers/agentos. Feature commits ship as patch releases while it is 0.x, and breaking changes ship as minors
2. Leave emergentConfig.allowSandboxTools off unless forged code runs through an executor that isolates. The default executor shares the host process
3. Pass your own ICheckpointStore to compile() for runs that must survive a restart. The default store is in memory
4. Set hitl.approvals.beforeTool for tools that write, and choose a handler. No approval gate is on by default
5. Use Node 22 or newer, and set a provider key such as OPENAI_API_KEY or ANTHROPIC_API_KEY. The provider is detected from the environment

Docker Agent

1. Set TELEMETRY_ENABLED=false before run or exec with a prompt on the command line. Telemetry is on by default and sends positional arguments
2. For unattended runs pass --safety restricted with an allow-list, or --sandbox. Without a policy, --exec rejects every tool call that needs approval
3. Set max_iterations and a budget block in the config. Both are unlimited by default
4. Run 1.130.0 or later. Earlier versions ran shell commands embedded in local skills, and A2A sessions before 1.126.0 skipped tool approval
5. Review runtime.safety in any config pulled from a registry or URL. An author default of autonomous runs every tool call unprompted