How to Enable YOLO Mode in Docker cagent

To run Docker cagent in YOLO mode, start it with docker agent run agent.yaml --yolo, or press Ctrl+Y (or type /yolo) in a running session. cagent has since been renamed Docker Agent, and --yolo is now the legacy name for its autonomous safety mode, one of four.

This page is one of our YOLO mode guides, and part of our guide to YOLO mode in every coding agent. Everything below was checked against the Docker Agent source and docs (docker/cagent, now github.com/docker/docker-agent, version 1.154.0) on October 30, 2026.

Docker Agent's Safety Modes

Docker Agent labels each tool call safe (a read-only tool, or a safe-listed command such as ls or git status), destructive (such as rm -rf) or unknown. The safety mode decides what happens to each label when no permission rule matches.

A session that never picks a mode keeps the old default: read-only tools run, everything else asks. restricted is the one to know about for unattended jobs. It never prompts, and refuses whatever it would have asked about.

How to Enable YOLO Mode in Docker cagent

docker agent run agent.yaml --yolo

For a new session the first of these wins: --safety, then --yolo, then the alias, then your user settings, then the agent YAML. Your own settings beat the agent author's, so an agent pulled from a registry cannot switch itself to YOLO over your settings.safety. A resumed session keeps its stored mode unless you pass --safety or --yolo again.

YOLO is not total. deny rules, session-scoped ask rules, tool guards and preempt_yolo hooks still block or prompt in autonomous mode.

The Halfway Option

balanced (--safety balanced, or B at a confirmation prompt) runs safe calls silently and asks about the rest. For hard limits on top of any mode, add allow, ask and deny permission rules.

Docker cagent's Sandbox

YOLO does not drop a sandbox, because there is none by default. Docker Agent has an optional sandbox mode, docker agent run --sandbox agent.yaml, which launches the agent inside a Docker Sandboxes VM with only the working directory mounted read-write. An alias can carry --sandbox too. Pairing --yolo with --sandbox is the closest thing to a safe YOLO run that Docker Agent offers on its own.

How to Enable YOLO Mode in Docker cagent Through AgentRQ

--yolo and Ctrl+Y live in the terminal. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal.

Approve From the AgentRQ Task Instead of the Terminal

Docker cagent is not in the ACP registry, so wrap its ACP command with the ACP Gateway (Docker cagent setup guide):

npx @agentrq/acp-gateway@latest -- <cagent-acp-command>

The ACP command is docker agent serve acp followed by your agent file or registry reference, so for example:

npx @agentrq/acp-gateway@latest -- docker agent serve acp ./agent.yaml

Over ACP, Docker Agent asks the client before tool calls, with three answers: allow this action, always allow this tool for this session, or skip it. Those requests now show up in the AgentRQ task on the web, on your phone or in Slack. Answer Allow Once, Always Allow or Deny from wherever you are, and the agent carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with --permission-timeout.

ACP sessions start in the default safety mode, and the ACP server also offers strict, balanced, restricted and autonomous as session modes. None of them is named as an asking mode, so AgentRQ leaves the session where it is. Don't serve an agent YAML that declares safety: autonomous, or the agent stops asking before AgentRQ sees anything.

Turn On YOLO for One Task

Flip the YOLO toggle on a task, or when you create it, to put just that task in YOLO mode. Every permission request in it is approved automatically and Docker cagent never waits, while every other task in the workspace still asks. Scheduled tasks, event triggers and workflow steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to Settings, choose the Automations tab and flip YOLO Mode (Execute All). Click Update Workspace to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

A Safe YOLO Setup for Docker cagent

• → Allow the boring tools, not everything. Always Allow adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
• → Keep deny rules in the agent config. They still apply when a task runs in YOLO, so a deny on commands like rm -rf holds either way.
• → Leave the workspace-wide switch off. Turn YOLO on per task instead, so it never outlives the job you trusted.
• → Contain it. Run the agent in a container or a throwaway clone, since docker agent serve acp runs tools on the machine it starts on.
• → Read the record. The tool call history lists every call the task made, including the ones that were auto-approved.

FAQ

How do I enable YOLO mode in Docker cagent? Run docker agent run agent.yaml --yolo, or press Ctrl+Y or type /yolo in a running session.

What is the difference between --yolo and --safety autonomous? None in effect. --yolo is the legacy alias for the autonomous safety mode, and --safety wins if you pass both.

How do I make YOLO the default in Docker cagent? Set settings.safety to autonomous in ~/.config/cagent/config.yaml, or create an alias with --yolo.

Does Docker cagent have a sandbox? Optionally. docker agent run --sandbox runs the agent in a Docker Sandboxes VM. It is off by default.

How do I approve Docker cagent tool calls remotely? Serve it over ACP and connect it to AgentRQ through the ACP Gateway. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see what YOLO mode is and how to turn it on in every coding agent.