The schedules guide used email delivery for its example. Replace it with a daily development digest saved as a GitHub issue, and focus the introduction on developer tasks.
The schedules guide qualified support based on account rollout state.
Remove those caveats so schedules and custom secrets are documented as supported.
The schedule guide limited credential preparation to model providers and did not explain how custom kits receive prompts. Include custom credentials, frame integrations around user needs, and describe how the kit prompt template builds the scheduled command.
Add a schedules guide covering recurring tasks, sandbox cleanup, and setup in the Console. Include a Jira digest example with MCP tools and explain custom-secret support for API integrations.
Pin Docker builds and Netlify previews to Hugo 0.169.0. Replace
deprecated `.Params.summary` lookups with `.RawSummary` in the guide
template.
Validation: the full minified debug build passed with
`--panicOnWarning`, path checks, and unused-template checks, with no
deprecation notices. Dockerfile and template formatting checks, Markdown
post-processing tests, rendered summary/redirect checks, and API output
validation passed.
Move rollout planning into Organization Setup and ongoing user access
guidance into Organization Manage. Preserve the planning, pilot,
provisioning, and review workflows while linking to canonical feature
procedures. Update navigation and the pilot tutorial, and retain both
guide URLs and all seven chapter redirects.
Validation: scoped rumdl and Vale passed with no alerts; Hugo build and
focused rendered checks passed for redirects, links, retained anchors,
cards, and sidebar order. Full validation reached htmltest but its
container failed with an ARM exec format error.
Move repository credential setup and a complete build-and-push workflow
into the GitHub Actions manual. Skip registry sign-in and publishing for
pull requests, and link to specialist examples for testing, metadata,
attestations, and multi-platform builds.
Remove the standalone guide and redirect `/guides/gha/` to the manual,
preserving existing aliases.
Validation: scoped rumdl and Vale checks, Hugo build, and rendered
workflow YAML, internal links, navigation, catalog removal, and
redirects. GitHub Actions execution was not tested. Some retired heading
fragments have no destination equivalent; three setup headings retain
compatible IDs.
## Description
Mention answering questions using official Docker documentation
alongside the existing Dockerfile and Compose examples in the Docker
Skills introduction. Keep the repository catalog as the place to find
individual skills and their descriptions.
## Related issues or tickets
Complements https://github.com/docker/docs/pull/26378, which advertises
Docker Skills in generated `llms.txt`.
## Reviews
Scoped rumdl and Vale checks pass with no errors, warnings, or
suggestions. `git diff --check` passes.
- [ ] Technical review
- [ ] Editorial review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Retire the two Bake guides and preserve their useful workflows in the
existing manual: Compose release overrides, grouped tests and lint
checks, artifact exports, and release/debug matrices. Redirect the guide
URLs and update inbound links.
Validation: resolved Bake configurations, runtime examples (including an
expected test failure), amd64/arm64 exports, Hugo rendering, redirects,
headings, and navigation checked. Markdown formatting passed. Scoped
lint reports pre-existing Vale findings only; full validation failed
during vendor extraction because the build ran out of disk space.
Whole-site link checks remain for CI.
## Summary
The lifecycle reference lists host command environment variables without
explaining their values. Replace the list with a table covering file
merge order, path separators, sandbox name overrides, and the empty
workspace value in cloud environments. Clarify that sbx commands run by
cloud lifecycle commands inherit cloud mode and the selected endpoint.
Companion to #26393; this change can merge independently. Verified
against docker/sandboxes release/v0.49 at c5b19951af12. Scoped rumdl and
Vale checks passed.
@netlify /ai/sandboxes/configuration/environment-files/
Generated by Codex
Update the host-only registry credential description to refer to `sbx`
as a whole, covering pulls authenticated by the daemon. The credential
storage commands and scope guidance are unchanged.
Validation: Markdown formatting and scoped rumdl/Vale checks passed.
The Agentic Platform docs referenced outdated Secrets controls and
omitted steps needed to configure MCP clients, network rules, and SSH
access. This updates the navigation and task guidance from the October
23 UI audit, including sandbox restore actions, kit filters, naming and
compute selection, and delayed usage reporting.
Each of the 11 audit findings has a separate commit. Feature
availability is qualified where it varies by account. Signup
requirements and pause/process semantics remain unchanged; process
restoration still needs product confirmation.
All seven changed Markdown files passed rumdl and Vale with no errors,
warnings, or suggestions.
@netlify /agentic-platform/
Generated by Codex
## Summary
The getting-started walkthrough promised a network preset prompt on the
first sandbox run, even when policy was already configured. Explain when
the CLI prompts, document `sbx policy init balanced` for manual
initialization, and remove outdated prompt transcripts from the
walkthrough and local-policy page. Also clarify that agent kits can add
model-provider allowances under Locked Down.
@netlify /ai/sandboxes/get-started/
Generated by Codex
Update `GO_VERSION` from 1.26 to 1.27 in the root and releaser
Dockerfiles. Keep the floating minor-version image tags used in
6a093939d4 and da3893027f; both 1.27 tags resolve to Go 1.27.3 on
October 26, 2026. Unlike those broader updates, this PR leaves module
files and the Go version used in documentation examples unchanged.
Docker Agent v1.151.0 and later require Go 1.27. The official Go image
sets `GOTOOLCHAIN=local`, so the Go 1.26 build cannot vendor those
releases. Daily `sync-docker-agent-docs` runs have failed since at least
October 24, 2026; the [October 26
run](https://github.com/docker/docs/actions/runs/40261071727) reports
this version mismatch while vendoring v1.152.0.
#26368 will be stacked on this PR to sync Docker Agent v1.152.0 and fix
the Community links. Merge this toolchain upgrade first.
Validation: `dockerfile-lint`, `releaser-build`, `releaser-test` (9
tests), and `validate-api-reference` passed with `docker buildx bake`.
Local `validate-vendor` and `test` hit the existing Community vendor
mismatch and nine missing references from the separately applied #26368
changes. CI on this isolated two-line PR is the authoritative check for
those targets.
Documents six user-facing changes in sbx 0.50: kit host mount bindings,
persistent kit volume retention, environment MCP command approvals and
ownership, HTTP query restrictions, cloud sandbox inspection, and exec
exit status in automation. Each change has its own commit. Also vendors
the matching v0.50 CLI reference verbatim and regenerates the release
notes from published GitHub releases.
Kit documentation focuses on sbx usage and links to the canonical
capability definitions. Volume retention follows the 0.50
implementation; the upstream spec's main branch describes a different
storage lifecycle.
Verified against the release implementation. Scoped Markdown and prose
lint, a full Hugo build, and checks of the added internal links pass.
Related release: https://github.com/docker/sandboxes/issues/7698
Generated by Codex
## Summary
The Git workflow guide omitted mountless repositories and suggested that
separate branches were enough to isolate simultaneous tasks. Add a
mountless workflow, compare where changes appear, clarify Git access in
direct mode, and align the workflows overview and Claude Code guidance
on using separate working directories.
Markdown and Vale checks pass for all three changed pages.
@netlify /ai/sandboxes/workflows/git/
Generated by Codex
## Description
Make the first Docker Agentic Platform session useful without a model
provider API key: launch the Shell kit, clone the Welcome to Docker
sample, build its container image, run the app, and preview it through
the Console's port connection. Readers can continue editing the same
project in VS Code or Cursor over SSH.
PReview:
https://deploy-preview-26413--docsdocker.netlify.app/agentic-platform/get-started/
## Summary
The cloud environment example didn't show how to work on a project, and
readers had to reach later subsections to discover the differences from
local sandboxes. Move the walkthrough into the cloud section, explain
those differences upfront, and show how to create an environment, copy
in a project, work with Claude Code, retrieve changes, and clean up.
Cover cloud credentials, expiration, unsupported settings, and reuse
limitations. Preserve the original entry anchor and update cloud
cross-references. Behavior checked against docker/sandboxes
release/v0.49 at c5b19951af12; scoped Markdown and Vale checks, Hugo
build, and rendered internal link checks passed. No live cloud session
was run.
@netlify /ai/sandboxes/cloud/environment-files/
Generated by Codex
Environment files were introduced mainly as an alternative to publishing
a kit set, leaving their broader role unclear. Explain near the top of
both pages how kits package software and its requirements while
environment files capture sandbox configuration, add reciprocal links,
and shorten the kit-set comparison.
Scoped rumdl and Vale checks pass for both changed pages.
@netlify /ai/sandboxes/customize/
Generated by Codex
Cached template images and existing sandboxes need updates after the external eMudhra certificate authority compromise. Add guidance for recreating sandboxes with refreshed images or updating CA certificates in place.
Update Sandboxes documentation for current kit validation and signing
behavior, host Git-ignore snapshots, cloud proxy support, and browser
and daemon logging settings. Correct SSH workspace, policy refresh,
automation, environment merging, and T3 toolchain guidance.
Keep offline checks alongside kit validation and inspection, consolidate
proxy explanations, and make toolchain installation conditional.
Preserve the upstream explanation of kit context files.
Regenerate the published v0.49.1 release notes and vendor the CLI YAML
from docker/sandboxes release/v0.49.
Each atomic change has its own commit. Rebased onto main. Scoped
Markdown and Vale checks, the Hugo build, and diff whitespace checks
passed. All 121 CLI YAML files parse and match upstream exactly.
Generated by Codex
Full template contents and T3 prerequisites did not reflect the included C/C++ toolchain. Document the tools and make manual installation conditional on missing dependencies.
Environment merging guidance could imply a later override repairs invalid input. Explain that every source file, including user defaults, must be valid before merging.
The automation guide did not identify quiet output for policies, settings, or approvals. List the returned identifiers and distinguish cloud policy output.
Automation guidance did not cover secret removals that match no stored entry. Explain the nonzero result and checking for matching secrets before cleanup.
Proxy guidance excluded host connections to cloud sandboxes. Document their proxy scope and the direct cloud SSH setting, and link the cloud SSH workflow to that guidance.
Git workflows did not explain how host ignore decisions reach local sandboxes. Document the creation-time snapshot and its limits without implying that ignored files are inaccessible.
The integration guide suggested SSH shells might start outside the primary workspace. State that interactive SSH starts in the sandbox workspace while editor folder pickers can choose another location.
The signing instructions did not account for Git changing signed file contents. Explain the signing warning and why local verification does not establish that committed bytes match.
Kit authors lacked guidance for checking local sources without a daemon or sign-in. Document offline validation and inspection, including the policy checks they skip.
## Description
Add Docker Skills to the discovery links near the top of generated
`llms.txt`, and point the MCP link to
`https://ai-backend-service.docker.com/mcp` for direct access to the
Docker RAG server.
Changes the Hugo template only; the generated file is not checked in.
## Reviews
Verified the skills page returns HTTP 200 and the MCP endpoint
initializes as `gordon-rag`. Rendered the updated template with Hugo in
a minimal site and confirmed both discovery links appear in the
generated header. `git diff --check` passes. A full docs-site build was
not run.
- [ ] Technical review
- [ ] Editorial review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Documentation updates can be technically accurate yet unnecessary,
duplicated, or poorly placed. Update research to justify an edit through
the reader's task and a specific documentation gap, write to integrate
it into the existing page, and review-changes to assess reader value,
placement, and flow.
Keep the guidance in the existing skills, without a required reporting
template. Each skill update has its own commit.
Markdown checks pass; Vale reports only pre-existing findings outside
the edited lines. Skill validation passes after excluding unchanged
Claude-specific metadata unsupported by the Codex validator.
Generated by Codex
Generated reference pages without modification dates appeared in the sitemap with lastmod set to 0001-01-01. Only render lastmod when the page has a nonzero date.
## Summary
Custom secret injection is limited to HTTP request headers, but the
credentials page recommended it for secrets in request bodies and
described replacement anywhere in a request. Remove that use case and
clarify the header-only restriction.
@netlify /ai/sandboxes/configuration/credentials/
Generated by Codex
## Description
Explain how the generated Kits section points agents to each kit's
guidance, including packaged context files under
`/usr/share/sandbox/kit/<stem>/` and the location of inline
instructions.
@netlify /ai/sandboxes/customize/use-kits/
Generated by Codex
Document `sbx mcp unload` for removing a server from a running sandbox
without restarting the agent. Explain how to reload it, distinguish
unloading from removing its registration, and describe what happens
after unloading all static servers.
Validation: Markdown and style checks pass.
Generated by Codex.
## Description
Built-in agent names select v2 kits, while published v3 workloads such
as `sbx/claude` collide with those names. This change recommends v3,
maps built-in agents to published v3 workloads with distinct names, and
shows compatible CLI, kit set, and environment-file examples. The
environment-file guide starts with a built-in v2 agent and links to a
separate v3 workflow.
Compatibility, capability requirements, and migration steps each live on
the page where readers need them.
Scoped Markdown and Vale checks pass. OCI manifests verify the v2
Playwright mixin and the published v3 references; v0.48.0
agent-registration and environment kit-resolution tests pass. A full
sandbox launch was unavailable because Docker sign-in is required in
this workspace.
@netlify /ai/sandboxes/customize/use-kits/
Generated by Codex
The Console getting started page ended at sandbox launch. Expand it into
a complete first session: review a public sample project with Claude
Code, inspect and save the result, optionally connect VS Code or Cursor
over SSH, and pause or delete the sandbox.
Preserves the sandbox options reference and existing heading anchors.
The platform overview remains the gateway to concepts; use-case guides
remain separate in #26321.
Formatting, scoped Markdown and Vale lint, Hugo build, and all 19
internal links passed. This remains a draft pending live Console, cloud
SSH, and editor verification.
@netlify /agentic-platform/get-started/
[Preview the
walkthrough](https://deploy-preview-26339--docsdocker.netlify.app/agentic-platform/get-started/)
Generated by Codex
## Summary
Update the Sandbox documentation for the v0.48.0 CLI refactor: renamed
flags, settings commands, terminal output, structured output, and
non-interactive confirmations. Add a migration reference for scripts and
CI workflows, with a [**Copy as prompt**
button](https://deploy-preview-26314--docsdocker.netlify.app/ai/sandboxes/workflows/automation/#update-scripts-for-v0480)
that copies agent instructions and the section Markdown.
This PR targets `main` independently of the other PRs in the sbx/v0.48.0
milestone. It keeps the generated reference import separate from
documentation edits:
- Vendor the 120 generated CLI YAML files
- Update command examples and guidance. Historical release notes retain
their original command spellings.
The other milestone PRs cover separate release features; this PR covers
the CLI migration.
@netlify /ai/sandboxes/workflows/automation/
Generated by Codex
Several sandbox feature guides omit supported tasks or describe them
inaccurately. This change fills those gaps in the documentation for
released Sandboxes v0.47.0 and organizes the additions around the tasks
readers need to complete.
- MCP: document DHI registration after the other server inputs, make
OAuth client changes a focused maintenance task, and place resource
overrides after normal OAuth setup.
- Environment files: consolidate file placement and write protection
after the first setup example, and explain plan output before listing
its symbols.
- Cloud: separate saving and reusing templates, importing local
templates, and customizing with kits. Explain capture modes beside the
relevant operations.
- Skills: correct import precedence, include OpenCode, and explain
skipped linked dependencies after the import command.
- Kits v2: correct the downloaded archive formats in the command entry
and put provenance inspection with signing and verification. Omit OCI
storage details that don't help complete these tasks.
Behavior was checked against the v0.47.0 source. In particular,
replacing an OAuth client secret does not clear its previous identity
binding; the recovery task retains the required reset and tells readers
to verify the intended client and provider first.
Validation: scoped Markdown and Vale lint passed, the full Hugo
development build passed, and checks of the five rendered guides
confirmed complete code blocks, visible placeholders, plan indentation,
valid same-page anchors, skills import order, and the revised task
headings. Changes are committed separately by issue. The v0.48 migration
remains in #26314.
```release-note
NONE
```
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
## Summary
The v2 kit reference says that adding a kit with startup commands
requires removing and recreating the sandbox. Document support for
startup commands through `sbx kit add` and explain when they run.
Implementation:
[docker/sandboxes#6886](https://github.com/docker/sandboxes/pull/6886).
Checked against the `release/v0.48` source and its regression coverage.
Changed Markdown passes rumdl and Vale.
For [Sandboxes
v0.48.0](https://github.com/docker/sandboxes/issues/7014); kept in draft
for the upcoming release.
@netlify /ai/sandboxes/customize/kits-v2/
Generated by Codex
Add a kit capability support reference showing local and cloud
availability, minimum `sbx` versions, capability-group behavior, and
restrictions on `sbx kit add`. Link it from the authoring overview and
clarify that v3 kits must request SSH-agent forwarding. Keep capability
definitions and examples in the upstream specification.
Validation: Markdown and style checks pass; upstream capability links
verified.
Generated by Codex.
Document the Windows SSH-agent fallback under `ssh.agentSocketPath`,
including what happens when both the setting and `SSH_AUTH_SOCK` are
unset. Keep the general SSH-agent guide focused on setup and linked to
the settings reference.
Validation: Markdown and style checks pass.
Generated by Codex.
Document how to select a model reasoning level with `sbx run --variant`,
with an example and the relevant agent limitations.
Validation: Markdown and style checks pass.
Generated by Codex.
Document desktop app connections that create a sandbox on first use and
reuse it on later connections. Keep the shared setup and lifecycle
behavior on the integrations overview, with brief links from the ChatGPT
and Claude Desktop pages.
Validation: Markdown and style checks pass.
Generated by Codex.
Document using stored API keys for hosted and custom model providers.
Explain how the host proxy supplies the key to the model service and
make clear that selecting a provider does not restrict the key to that
provider's endpoint. Clarify the environment-variable fallback.
Validation: Markdown and style checks pass.
Generated by Codex.
Document expiration settings for cloud moves and environments, including
automatic restart at expiration. Organize the cloud environment guidance
into task sections covering setup, supported settings, expiration,
credentials, reuse, removal, and recovery.
Validation: Markdown and style checks pass.
Generated by Codex.
## Summary
Kit authors can use `SBX_AGENT` to choose setup behavior for the
provisioned agent. Document the value for built-in and custom agents,
and how install hooks request the variable.
Implementation:
[docker/sandboxes#6876](https://github.com/docker/sandboxes/pull/6876).
Checked against the `release/v0.48` source and its regression coverage.
Changed Markdown passes rumdl and Vale.
For [Sandboxes
v0.48.0](https://github.com/docker/sandboxes/issues/7014); kept in draft
for the upcoming release.
@netlify
/ai/sandboxes/customize/author/#pass-environment-variables-to-hooks
Generated by Codex
## Summary
The build policy docs covered HTTP downloads through `ADD` but did not
explain how to block URLs requested by `RUN` steps. Add a tested
allowlist example using `"caps": {"exec.proxy": true}` in the policy
file and update the HTTP input reference, with a brief builder flag
example for CI.
Verified that Debian package downloads pass and the blocked URL returns
HTTP 403 and fails the build. Scoped Markdown and Vale checks passed,
with one existing Vale warning on unchanged text.
@netlify /build/policies/usage/
Generated by Codex
## Summary
Removes files left over from earlier agent tooling that nothing
references anymore, and moves the `curate-whats-new` examples next to
the skill that uses them.
- Delete `tech_writer.yml` and `docs_engineer.yml`, unused docker-agent
configs, and the `.validation.log` ignore entry that only they wrote.
- Delete `.github/prompts/`, unreferenced Copilot prompt files that link
to a nonexistent style guide.
- Move `.github/agents/whats-new-examples/` to
`.agents/skills/curate-whats-new/examples/`.
`.github/agents/docs-scanner.yaml` and the `docker-agent-action`
workflows stay, since CI still uses them.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
## Summary
Remove experimental badges and notices for the Cloud Sandboxes CLI, API,
and SDK, including the API reference card and CLI release notes.
Preserve the Docker Agentic Platform experimental status, the
subscription requirement, and feature-specific experimental warnings.
@netlify /ai/sandboxes/cloud/
Generated by Codex
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
## Summary
Gordon's Supplemental Terms are no longer in effect. Replace the
reference under Questions about privacy with a link to the Docker
Subscription Service Agreement.
@netlify /ai/gordon/concepts/data-privacy/
Generated by Codex
Monitoring guides were grouped under CI/CD, and several other guides had
categories that did not match their main purpose. Add Observability,
rename Deployment to Services & infrastructure, and move LocalStack and
Django into Testing and Languages & frameworks.
Remove the E2B workflow and integration documentation and both Ollama
application guides. Remove E2B navigation and promotional links.
Redirect former E2B URLs to Docker Sandboxes and former Ollama guide URLs
to Docker Model Runner.
The Build Cloud, Compose, Scout, Testcontainers Cloud, and
container-supported development guides mostly repeat product benefits
and introduce videos instead of teaching distinct tasks.
Remove these five guides and their unused images, update incoming links,
and redirect all former page and chapter URLs to the relevant product
docs or hands-on lab. Keep both administration guides.
The Testcontainers collection includes nine specialized Java integration
tutorials with modest readership and overlapping framework setup.
Remove these guides and their links from the Testcontainers overview,
retaining eleven guides covering language introductions, general
techniques, representative web frameworks, and Testcontainers Cloud.
The NLP examples, TensorFlow.js face detection guide, Neo4j RAG guide,
and video chatbot guide have low readership and repeat application
setup or containerization covered by other guides.
Remove these eight guides and the nine images used only by them.
No remaining content or config entries reference the removed guides.
## Description
Documents the user-facing changes in Docker Sandboxes v0.47.0 and
updates the CLI reference.
- `sbx run --rm` removes the sandbox when the agent exits, for local and
cloud sandboxes.
- `sbx run --detached` keeps a local sandbox running after its sessions
end.
- Kits can declare the `long-running@1` capability to keep their sandbox
running.
- `sbx move` to the cloud applies the kit's network rules.
- MCP authorization requests `offline_access` with default scopes, so
servers can issue refresh tokens.
- UDP to local-network destinations is blocked regardless of network
policy.
- `sbx --cloud ttl` reports stopped sandboxes as stopped instead of
expired.
- The CLI reference is updated for v0.47.0.
@netlify /ai/sandboxes/usage/
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
sbx --cloud ttl no longer reports a stopped sandbox as expired. Explain
that resuming starts a new time-to-live period and describe the
stopped and ttl_paused JSON fields.
Source: docker/sandboxes#6388
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
UDP to multicast, link-local, unspecified, and broadcast destinations
is dropped before policy evaluation, so no allow rule can permit it.
Explain the effect on discovery protocols and how the network log
reports these connections.
Source: docker/sandboxes#5875
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
When sbx uses recorded default or resource-required scopes, it also
requests offline_access if the authorization server advertises it, so
the server can issue a refresh token. Explicit --scope values are
requested as given.
Source: docker/sandboxes#6284
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
sbx move --to cloud now applies the sandbox's kit or agent network
rules, as sbx --cloud create does. Rules added locally still don't
transfer. Correct the move and cloud network policy pages, which said
no local rules apply.
Source: docker/sandboxes#6707 (backported as #6814)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain how a kit declares long-running@1 to keep its sandbox running
after sessions end, how required and optional entries behave, and that
cloud sandboxes and sbx kit add can't provide it.
Source: docker/sandboxes#6710
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain that sbx run --detached keeps a local sandbox running after its
sessions end, and that running it against an existing sandbox switches
that sandbox to detached mode permanently.
Source: docker/sandboxes#6600
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain that --rm removes a local or cloud sandbox when the agent
session exits, when a reattached sandbox is kept, and why --rm can't be
combined with --detached or --detach-keys.
Source: docker/sandboxes#6601
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
See commit message(s).
Just fixes a small hiccup on the docs! It makes it sounds like Debian
comes with ufw but it doesn't.
> nftables is the default and recommended firewalling framework in
Debian…
>
> It is recommended to run
[?](https://wiki.debian.org/firewalld)firewalld…
>
> \- [Debian Wiki: nftables](https://wiki.debian.org/nftables)
Just to confirm, I also installed Debian on a VM and checked if ufw was
present, and indeed it wasn't. This was run on a fresh express Debian
install:
```txt
root@debian13-uni:/home/seth# ufw
bash: ufw: command not found
root@debian13-uni:/home/seth#
```
- [ ] Technical review
- [x] Editorial review
- [ ] Product review
David Karlsson
