---
title: "How to Enable YOLO Mode in Docker cagent | AgentRQ Guidelines"
url: https://agentrq.com/guidelines/yolo-mode/docker-cagent
description: "Docker cagent (now Docker Agent) YOLO mode: docker agent run --yolo, /yolo or Ctrl+Y, or --safety autonomous. Safety modes, sandbox and AgentRQ."
---

![](https://agentrq.com/assets/agent-icons/docker-cagent.png) Checked October 30, 2026 | [All YOLO Mode guides](https://agentrq.com/guidelines/yolo-mode/)

# How to Enable YOLO Mode in Docker cagent

To run Docker cagent in YOLO mode, start it with `docker agent run agent.yaml --yolo`, or press **Ctrl+Y** (or type `/yolo`) in a running session. cagent has since been renamed **Docker Agent**, and `--yolo` is now the legacy name for its `autonomous` safety mode, one of four.

This page is one of our [YOLO mode guides](https://agentrq.com/guidelines/yolo-mode/), and part of our guide to [YOLO mode in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent). Everything below was checked against the Docker Agent source and docs (docker/cagent, now github.com/docker/docker-agent, version 1.154.0) on October 30, 2026.

![Animated sketch of YOLO mode in AgentRQ: claude waits to run go test, YOLO is flipped on for the task, and every later edit and test run lands auto-allowed in the Trajectory view](https://agentrq.com/assets/sketches/yolo-mode.svg)

## Docker Agent's Safety Modes

Docker Agent labels each tool call **safe** (a read-only tool, or a safe-listed command such as `ls` or `git status`), **destructive** (such as `rm -rf`) or **unknown**. The safety mode decides what happens to each label when no permission rule matches.

| Mode | safe | destructive | unknown |
| --- | --- | --- | --- |
| `strict` | ask | ask | ask |
| `balanced` | run | ask | ask |
| `restricted` | run | deny | deny |
| `autonomous` (YOLO) | run | run | run |

A session that never picks a mode keeps the old default: read-only tools run, everything else asks. `restricted` is the one to know about for unattended jobs. It never prompts, and refuses whatever it would have asked about.

## How to Enable YOLO Mode in Docker cagent

| Where | YOLO |
| --- | --- |
| Command line | `docker agent run agent.yaml --yolo` or `--safety autonomous` |
| In a session | **Ctrl+Y** or `/yolo` (toggles), or **A** at a confirmation prompt |
| Alias | `docker agent alias add yolo-coder myorg/coder --yolo` |
| User config | `settings.safety: autonomous` (or the legacy `YOLO: true`) in `~/.config/cagent/config.yaml` |
| Agent YAML | `agents.<name>.safety` or `runtime.safety` |

bash

```bash
docker agent run agent.yaml --yolo
```

For a new session the first of these wins: `--safety`, then `--yolo`, then the alias, then your user settings, then the agent YAML. Your own settings beat the agent author's, so an agent pulled from a registry cannot switch itself to YOLO over your `settings.safety`. A resumed session keeps its stored mode unless you pass `--safety` or `--yolo` again.

YOLO is not total. `deny` rules, session-scoped `ask` rules, tool guards and `preempt_yolo` hooks still block or prompt in autonomous mode.

### The Halfway Option

`balanced` (`--safety balanced`, or **B** at a confirmation prompt) runs safe calls silently and asks about the rest. For hard limits on top of any mode, add `allow`, `ask` and `deny` permission rules.

## Docker cagent's Sandbox

YOLO does not drop a sandbox, because there is none by default. Docker Agent has an optional **sandbox mode**, `docker agent run --sandbox agent.yaml`, which launches the agent inside a Docker Sandboxes VM with only the working directory mounted read-write. An alias can carry `--sandbox` too. Pairing `--yolo` with `--sandbox` is the closest thing to a safe YOLO run that Docker Agent offers on its own.

## How to Enable YOLO Mode in Docker cagent Through AgentRQ

`--yolo` and Ctrl+Y live in the terminal. AgentRQ lets you make the decision per task, and answer from somewhere other than the terminal.

### Approve From the AgentRQ Task Instead of the Terminal

Docker cagent is not in the ACP registry, so wrap its ACP command with the [ACP Gateway](https://agentrq.com/docs/connect-acp-agent) ([Docker cagent setup guide](https://agentrq.com/docs/agents/docker-cagent)):

bash

```bash
npx @agentrq/acp-gateway@latest -- <cagent-acp-command>
```

The ACP command is `docker agent serve acp` followed by your agent file or registry reference, so for example:

bash

```bash
npx @agentrq/acp-gateway@latest -- docker agent serve acp ./agent.yaml
```

Over ACP, Docker Agent asks the client before tool calls, with three answers: allow this action, always allow this tool for this session, or skip it. Those requests now show up in the AgentRQ task on the web, on your phone or in Slack. Answer **Allow Once**, **Always Allow** or **Deny** from wherever you are, and the agent carries on. If nobody answers within 30 minutes, the gateway cancels the turn instead of guessing. Change the limit with `--permission-timeout`.

ACP sessions start in the `default` safety mode, and the ACP server also offers `strict`, `balanced`, `restricted` and `autonomous` as session modes. None of them is named as an asking mode, so AgentRQ leaves the session where it is. Don't serve an agent YAML that declares `safety: autonomous`, or the agent stops asking before AgentRQ sees anything.

### Turn On YOLO for One Task

Flip the **YOLO** toggle on a task, or when you create it, to put just that task in [YOLO mode](https://agentrq.com/features/yolo-mode). Every permission request in it is approved automatically and Docker cagent never waits, while every other task in the workspace still asks. [Scheduled tasks](https://agentrq.com/features/task-scheduling), [event triggers](https://agentrq.com/features/events) and [workflow](https://agentrq.com/features/workflows) steps have the same switch, so an unattended job can run in YOLO while your interactive work stays supervised.

![The YOLO toggle on a task in AgentRQ being switched on, then off again](https://agentrq.com/assets/guidelines/yolo-mode-task-toggle.gif)

### Turn YOLO On or Off in Workspace Settings

To make YOLO the default for a whole workspace, open the workspace, go to **Settings**, choose the **Automations** tab and flip **YOLO Mode (Execute All)**. Click **Update Workspace** to save. Switch it off the same way. The switch is off by default, and every permission request in the workspace is approved automatically while it is on.

![Workspace Settings in AgentRQ: the YOLO Mode (Execute All) switch turned on and saved, then off and saved](https://agentrq.com/assets/guidelines/yolo-mode-workspace-settings.gif)

### A Safe YOLO Setup for Docker cagent

- → **Allow the boring tools, not everything.** **Always Allow** adds the tool to the workspace's auto-approved list, so the routine calls stop asking and the risky ones still do. Prune that list in workspace settings now and then.
- → **Keep deny rules in the agent config.** They still apply when a task runs in YOLO, so a `deny` on commands like `rm -rf` holds either way.
- → **Leave the workspace-wide switch off.** Turn YOLO on per task instead, so it never outlives the job you trusted.
- → **Contain it.** Run the agent in a container or a throwaway clone, since `docker agent serve acp` runs tools on the machine it starts on.
- → **Read the record.** The [tool call history](https://agentrq.com/features/tool-call-history) lists every call the task made, including the ones that were auto-approved.

## FAQ

**How do I enable YOLO mode in Docker cagent?** Run docker agent run agent.yaml --yolo, or press Ctrl+Y or type /yolo in a running session.

**What is the difference between --yolo and --safety autonomous?** None in effect. --yolo is the legacy alias for the autonomous safety mode, and --safety wins if you pass both.

**How do I make YOLO the default in Docker cagent?** Set settings.safety to autonomous in ~/.config/cagent/config.yaml, or create an alias with --yolo.

**Does Docker cagent have a sandbox?** Optionally. docker agent run --sandbox runs the agent in a Docker Sandboxes VM. It is off by default.

**How do I approve Docker cagent tool calls remotely?** Serve it over ACP and connect it to [AgentRQ](https://agentrq.com) through the ACP Gateway. Its permission requests show up in the task on the web, your phone or Slack.

For every other agent, see [what YOLO mode is and how to turn it on in every coding agent](https://agentrq.com/blog/what-is-yolo-mode-and-how-to-turn-it-on-in-every-coding-agent).