From bb72d4e7d0c7128352eb43663204d27ad579f636 Mon Sep 17 00:00:00 2001
From: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Date: Tue, 3 Nov 2026 12:30:54 +0000
Subject: [PATCH] docs: separate sandbox SSH access from commit signing

SSH access and commit signing use different keys. Document creation of the Docker-managed signing key separately from SSH key registration, with steps to add its public key to GitHub.
---
 content/manuals/agentic-platform/sandboxes.md | 32 ++++++++++++-------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/content/manuals/agentic-platform/sandboxes.md b/content/manuals/agentic-platform/sandboxes.md
index e510780049..473fa2a0ff 100644
--- a/content/manuals/agentic-platform/sandboxes.md
+++ b/content/manuals/agentic-platform/sandboxes.md
@@ -82,9 +82,7 @@ in the panel for your chosen connection method.
 
 ### Register an SSH key
 
-To sign Git commits in Docker Agentic Platform, register your public SSH key
-in the Console and add the same key to GitHub as a signing key. You can also
-use the registered key to connect to your sandbox over SSH.
+Register your public SSH key to connect to your sandbox from your computer.
 
 1. Open the user menu and select **Settings**.
 2. Under **Sandbox SSH key**, optionally enter a **Name** for the key.
@@ -96,14 +94,6 @@ Only the public key is stored. It takes effect immediately, without restarting
 a sandbox. Check **Registered key** to review it. Adding another key replaces
 the registered key. To remove it, select **Delete key** and confirm deletion.
 
-After registering the key, add the same public key to your GitHub account
-as a signing key:
-
-1. In your GitHub account settings, open **SSH and GPG keys** and select
-   **New SSH key**.
-2. Choose **Signing Key** as the key type, paste the same public key, and
-   select **Add SSH key**.
-
 ### Access a service by port
 
 To access a web application or development server running in your sandbox:
@@ -117,6 +107,26 @@ The sandbox must be running. Port 2222 is reserved for SSH and can't be
 published through this control. To stop exposing a service, use the close
 action next to its port.
 
+## Sign Git commits
+
+Docker Agentic Platform generates a key pair for signing Git commits made by
+agents in your cloud sandboxes. Docker keeps the private key outside the
+sandbox and displays the public key in **Settings**. This signing key is
+separate from the key you register for SSH access to a sandbox.
+
+To have GitHub verify commits signed with this key:
+
+1. Open the Console user menu and select **Settings**.
+2. Under **Commit signing**, select **Create signing key**.
+3. Copy the public signing key displayed in **Signing key**.
+4. In your GitHub account settings, open **SSH and GPG keys** and select
+   **New SSH key**.
+5. Choose **Signing Key** as the key type, paste the public signing key, and
+   select **Add SSH key**.
+
+Use an email address verified on your GitHub account for the Git identity
+shown under **Git identity** in the Console settings.
+
 ## Pause, resume, or delete a sandbox {#manage-the-lifecycle}
 
 A sandbox can be running or paused: