From 12d9ac4a095985f9083d2c6cd9b28a8145a3f067 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Fri, 2 Oct 2026 11:10:08 +0200 Subject: [PATCH] sbx: explain kit network rules on move to cloud sbx move --to cloud now applies the sandbox's kit or agent network rules, as sbx --cloud create does. Rules added locally still don't transfer. Correct the move and cloud network policy pages, which said no local rules apply. Source: docker/sandboxes#6707 (backported as #6814) Co-Authored-By: Claude Opus 5.5 Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- content/manuals/ai/sandboxes/cloud/move.md | 10 ++++++---- content/manuals/ai/sandboxes/cloud/network-policy.md | 3 ++- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/content/manuals/ai/sandboxes/cloud/move.md b/content/manuals/ai/sandboxes/cloud/move.md index 2e2f053846..3b0de88b0a 100644 --- a/content/manuals/ai/sandboxes/cloud/move.md +++ b/content/manuals/ai/sandboxes/cloud/move.md @@ -72,10 +72,12 @@ appear in the cloud destination. When the source has a workspace, the CLI warns and asks for confirmation. The `--force` flag skips the prompt but doesn't include those files. -The destination uses cloud network policy. Local network rules don't transfer. -If the local source has HTTP method or path restrictions, the CLI warns and -asks for confirmation because those restrictions won't apply in the cloud. -`--force` skips the prompt but retains the warning. +The destination uses cloud network policy and the network rules of the +sandbox's kit, or of its built-in agent, as `sbx --cloud create` does. Network +rules you added locally don't transfer. If the local source has HTTP method or +path restrictions, the CLI warns and asks for confirmation because those +restrictions won't apply in the cloud. `--force` skips the prompt but retains +the warning. Published TCP sandbox ports are published on the cloud destination with cloud URLs. Ports that the cloud refuses are skipped with a warning. Host port diff --git a/content/manuals/ai/sandboxes/cloud/network-policy.md b/content/manuals/ai/sandboxes/cloud/network-policy.md index 2f2f6ab2f3..85cf01026e 100644 --- a/content/manuals/ai/sandboxes/cloud/network-policy.md +++ b/content/manuals/ai/sandboxes/cloud/network-policy.md @@ -26,7 +26,8 @@ precedence over allow rules across the applicable policies. Cloud creation uses cloud account policy, network rules passed to the command, and network access declared by the agent or kit. Both `sbx --cloud create` and `sbx --cloud run` leave local network and organization policies on the host. -Moving a local sandbox to the cloud also uses cloud policy. +Moving a local sandbox to the cloud works the same way, except that rules you +added locally don't transfer. Define the intended policy in the cloud store. After creation, inspect the configured rules and [verify connection decisions](#inspect-network-policy).