The settings reference omitted the persistent telemetry opt-out. Document its default, restart timing, and environment-variable behavior, and link to it from the FAQ.
The telemetry FAQ only described opting out through an environment variable. Add the saved local preference, daemon restart command, and environment-variable precedence.
## Description
The rclone example in the volumes guide installs the plugin with
`--aliases rclone`. `docker plugin install` has no `--aliases` flag, so
the command fails before it reaches the daemon:
```console
$ docker plugin install --grant-all-permissions rclone/docker-volume-rclone --aliases rclone
unknown flag: --aliases
```
The flag is `--alias` ("Local name for plugin"), as listed in the
[`docker plugin install`
reference](https://docs.docker.com/reference/cli/docker/plugin/install/)
and used in the [rclone Docker plugin docs](https://rclone.org/docker/).
The later steps in the guide use `-d rclone` and `volume-driver=rclone`,
so they need the plugin to be installed under that alias.
I checked the flag parsing with Docker CLI 29.1.3 against a non-existent
daemon socket: `--aliases` fails with `unknown flag`, while `--alias
rclone` parses and only fails to connect. `npx --no-install rumdl fmt`
and `scripts/lint.sh` (rumdl 0.2.49, Vale 3.17.0) report no issues on
the changed line.
## Related issues or tickets
None.
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
## Description
Add `COPY --chmod=755` to the wrapper-script copy instruction in both
examples on the [multiple-process container
guide](https://docs.docker.com/engine/containers/multi-service_container/).
A newly created wrapper commonly has mode `0644`; `COPY` preserves that
mode, so `CMD ./my_wrapper_script.sh` exits with 126 before the script
starts.
The issue reproduction was run verbatim. With `umask 022`, the original
Dockerfile returned 126 with `Permission denied`; the `COPY --chmod=755`
control ran successfully, as did the original Dockerfile after making
the host wrapper executable. Both documented recipes were also
reproduced with deterministic stand-ins; the job-control recipe's mode
control was run with a TTY.
Validation: `npx --no-install rumdl fmt` (rumdl 0.2.49) and
`scripts/lint.sh` (rumdl 0.2.49, Vale 3.17.0) passed on the changed
file. No full-site build was run for this two-line documentation change.
## Related issues or tickets
Fixes#26447
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: maheshrijal <62394512+maheshrijal@users.noreply.github.com>
## Summary
- Stop mounting Docker Agent Community on docs.docker.com; keep
technical sections and Guides mounted.
- Sync the module pin and generated vendor files to Docker Agent
v1.152.0, which includes docker/docker-agent#4618 (`cc52bd76`).
- Redirect the Community root, Contributing, and Resources to GitHub
Pages. Preserve the three technical-page redirects through upstream
aliases.
## Merge order
Depends on #26451 for Go 1.27. This branch includes its commit by
ancestry; both PRs target `main`. Merge #26451 first.
Coordinate with the docs team: this supersedes the sync in #25913. Draft
#25919 remains suspended and compatible. Neither bot PR was edited or
closed.
## Redirects
| Former `/ai/docker-agent/` path | Destination |
| --- | --- |
| `community/` |
https://docker.github.io/docker-agent/community/contributing/ |
| `community/contributing/` |
https://docker.github.io/docker-agent/community/contributing/ |
| `community/resources/` |
https://docker.github.io/docker-agent/community/resources/ |
| `community/telemetry/` | `/ai/docker-agent/configuration/telemetry/` |
| `community/opentelemetry/` |
`/ai/docker-agent/configuration/opentelemetry/` |
| `community/troubleshooting/` |
`/ai/docker-agent/guides/troubleshooting/` |
The GitHub Pages `/community/` root returns 404, so the former section
root redirects to Contributing.
## Validation
CI passes, including build, vendor validation, and redirect tests. Local
checks passed for all 9 redirect unit tests, six generated mappings, and
24 CloudFront cases covering trailing slashes and query strings.
Update `GO_VERSION` from 1.26 to 1.27 in the root and releaser
Dockerfiles. Keep the floating minor-version image tags used in
6a093939d4 and da3893027f; both 1.27 tags resolve to Go 1.27.3 on
October 26, 2026. Unlike those broader updates, this PR leaves module
files and the Go version used in documentation examples unchanged.
Docker Agent v1.151.0 and later require Go 1.27. The official Go image
sets `GOTOOLCHAIN=local`, so the Go 1.26 build cannot vendor those
releases. Daily `sync-docker-agent-docs` runs have failed since at least
October 24, 2026; the [October 26
run](https://github.com/docker/docs/actions/runs/40261071727) reports
this version mismatch while vendoring v1.152.0.
#26368 will be stacked on this PR to sync Docker Agent v1.152.0 and fix
the Community links. Merge this toolchain upgrade first.
Validation: `dockerfile-lint`, `releaser-build`, `releaser-test` (9
tests), and `validate-api-reference` passed with `docker buildx bake`.
Local `validate-vendor` and `test` hit the existing Community vendor
mismatch and nine missing references from the separately applied #26368
changes. CI on this isolated two-line PR is the authoritative check for
those targets.
## Description
Adds public documentation for `GET /v2/auditlogs/governance/{org_name}`
and aligns the guide and OpenAPI reference with merged data-platform
main (`66bc70971`), including
[docker/data-platform#2711](https://github.com/docker/data-platform/pull/2711)
and
[docker/data-platform#2712](https://github.com/docker/data-platform/pull/2712).
- Documents raw Organization Access Token authentication and the View
audit logs permission.
- Covers the 25-event default, 100-event page cap, 30-day request
window, and cursor-preserved time bounds. Text search can use the
default window.
- Documents the API and gateway organization limits of 5 requests per
second and the gateway limit of 600 requests per minute per source IP.
Clients and tokens share the organization limits, and each pagination
request counts.
- Updates the structured application 429 example to `limit: 5`,
`window_seconds: 1`, and `retry_after_seconds: 1`.
- Keeps Retry-After optional: application responses include it when the
reset time is known, while gateway responses can omit it and use a
different body. The chart-owned Lua policy was removed in
[docker/data-platform#2725](https://github.com/docker/data-platform/pull/2725);
these docs do not promise gateway header translation.
- Covers request deadlines, search timeouts, and retryable dependency
failures, with links to the audit record reference and
subscription/access-token pages.
## Release status
The production route and gateway policies are enabled in the merged
configuration. One unauthenticated GET to
`https://api.docker.com/v2/auditlogs/governance/vonwig?page_size=1`
returned HTTP 401 with `{"error":"missing or malformed Authorization
header"}`, confirming public routing and missing-token rejection.
Before publishing, confirm the OAT View audit logs permission is
available in Docker Home and record authorized production
query/pagination, organization/IP throttling, retry behavior, and
monitoring validation. No authenticated request or rate-limit load test
was performed in this update. Merged configuration and a 401 response do
not establish those outcomes.
## Validation
- Scoped rumdl and Vale checks: passed with 0 errors, warnings, or
suggestions.
- Prettier check for the OpenAPI YAML: passed.
- OpenAPI 3.0 validation: passed using @apidevtools/swagger-parser
10.1.0.
- Public server and application 429 example checked against the merged
production values.
- `git diff --check`: passed.
- Full Hugo rendering and rendered link validation were not run; PR CI
and the deploy preview still need review.
Documents six user-facing changes in sbx 0.50: kit host mount bindings,
persistent kit volume retention, environment MCP command approvals and
ownership, HTTP query restrictions, cloud sandbox inspection, and exec
exit status in automation. Each change has its own commit. Also vendors
the matching v0.50 CLI reference verbatim and regenerates the release
notes from published GitHub releases.
Kit documentation focuses on sbx usage and links to the canonical
capability definitions. Volume retention follows the 0.50
implementation; the upstream spec's main branch describes a different
storage lifecycle.
Verified against the release implementation. Scoped Markdown and prose
lint, a full Hugo build, and checks of the added internal links pass.
Related release: https://github.com/docker/sandboxes/issues/7698
Generated by Codex
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
The policy guide teaches the hidden filename flag and omits stdin input
and platform selection. Use the supported file flag and add examples for
both capabilities.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The Bake guides only describe environment-based variable overrides.
Add var flag examples, precedence and type behavior, and its distinction
from target attribute overrides.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The guide incorrectly states that Bake policy options require CLI flags.
Document policy objects in HCL and show explicit loading with strict mode.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Buildx registry credential selection has no home in the build guides.
Add a registry authentication page covering scoped configurations and
keep only a cross-reference in the variable reference.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Adds a Manage licenses row to the Organization management table on the
core roles page (Member/Editor ❌, Owner ✅).
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Description
Standardizes the terminology used to describe Gordon’s free tier across
the documentation.
- Replaces **“Personal (free) subscription”** with **“Base tier
(free)”** in the Gordon data privacy documentation.
- Aligns the terminology with the existing Gordon usage-limits
documentation.
- Preserves the existing data retention policy and all related
explanations.
This change improves consistency and clarity for readers without
changing the documented data privacy practices.
## Related issues or tickets
Closes#26419
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Summary
The Git workflow guide omitted mountless repositories and suggested that
separate branches were enough to isolate simultaneous tasks. Add a
mountless workflow, compare where changes appear, clarify Git access in
direct mode, and align the workflows overview and Claude Code guidance
on using separate working directories.
Markdown and Vale checks pass for all three changed pages.
@netlify /ai/sandboxes/workflows/git/
Generated by Codex
## Description
Make the first Docker Agentic Platform session useful without a model
provider API key: launch the Shell kit, clone the Welcome to Docker
sample, build its container image, run the app, and preview it through
the Console's port connection. Readers can continue editing the same
project in VS Code or Cursor over SSH.
PReview:
https://deploy-preview-26413--docsdocker.netlify.app/agentic-platform/get-started/
## Summary
The cloud environment example didn't show how to work on a project, and
readers had to reach later subsections to discover the differences from
local sandboxes. Move the walkthrough into the cloud section, explain
those differences upfront, and show how to create an environment, copy
in a project, work with Claude Code, retrieve changes, and clean up.
Cover cloud credentials, expiration, unsupported settings, and reuse
limitations. Preserve the original entry anchor and update cloud
cross-references. Behavior checked against docker/sandboxes
release/v0.49 at c5b19951af12; scoped Markdown and Vale checks, Hugo
build, and rendered internal link checks passed. No live cloud session
was run.
@netlify /ai/sandboxes/cloud/environment-files/
Generated by Codex
Environment files were introduced mainly as an alternative to publishing
a kit set, leaving their broader role unclear. Explain near the top of
both pages how kits package software and its requirements while
environment files capture sandbox configuration, add reciprocal links,
and shorten the kit-set comparison.
Scoped rumdl and Vale checks pass for both changed pages.
@netlify /ai/sandboxes/customize/
Generated by Codex
Refresh on top billing docs :)
TO DO:
Confirm Docker Offload situation
Remove random link to Testcontainers (?)
Review that Manage your plans h2 lol
Co-authored-by: Cursor <cursoragent@cursor.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
Cached template images and existing sandboxes need updates after the external eMudhra certificate authority compromise. Add guidance for recreating sandboxes with refreshed images or updating CA certificates in place.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: aevesdocker <allie.sadler@docker.com>
Update Sandboxes documentation for current kit validation and signing
behavior, host Git-ignore snapshots, cloud proxy support, and browser
and daemon logging settings. Correct SSH workspace, policy refresh,
automation, environment merging, and T3 toolchain guidance.
Keep offline checks alongside kit validation and inspection, consolidate
proxy explanations, and make toolchain installation conditional.
Preserve the upstream explanation of kit context files.
Regenerate the published v0.49.1 release notes and vendor the CLI YAML
from docker/sandboxes release/v0.49.
Each atomic change has its own commit. Rebased onto main. Scoped
Markdown and Vale checks, the Hugo build, and diff whitespace checks
passed. All 121 CLI YAML files parse and match upstream exactly.
Generated by Codex
Full template contents and T3 prerequisites did not reflect the included C/C++ toolchain. Document the tools and make manual installation conditional on missing dependencies.
David Karlsson
Jooyoung Lim
Mahesh Rijal
Arnaud Héritier
Brian Refsdal
CrazyMax
Allie Sadler
Alexa KristensenandCursor
Zainab Oladimeji
Oladosu Ibrahim