Vendor the checked-in CLI YAML from Docker Sandboxes release/v0.51 at
7d55286de0c7. This updates command help, adds `sbx policy check http`,
and replaces seven agent-specific create pages with redirects to `sbx
create`.
Validation: full site build with Hugo 0.169.0; upstream byte-for-byte
comparison; all 115 command pages, reference links, and seven redirects
checked; template formatting and whitespace checks passed.
Explain how built-in names such as `claude` and `codex` resolve to
Docker Hub kits, with the canonical Codex reference as an example.
Distinguish these references from the versioned v3 workloads listed in
the guide.
Validation: Markdown formatting and scoped rumdl/Vale checks passed with
no findings. Runtime examples were not run because `sbx` was
unavailable.
Explain that image pulls on Linux can fail with an I/O error when
sandbox state is on eCryptfs. Identify the diagnostic warning and
recommend another filesystem for sandbox state to help users recognize
the storage issue.
Validation: scoped rumdl and Vale checks passed. Runtime behavior was
not verified because the sbx binary was unavailable.
Update the Sandboxes FAQ with the saved local telemetry opt-out and
daemon restart command. Explain when the CLI and daemon adopt the
preference and that `SBX_NO_TELEMETRY=0` does not override it.
Validation: Markdown formatting and scoped rumdl/Vale checks passed.
Command examples were not run because `sbx` was unavailable. Confirm
release availability before publishing.
Document `--value-stdin` for local and cloud custom secrets, including
incompatible flags, and update the OpenCode example to pipe its API key.
Explain why passing an expanded environment variable with `--value`
still exposes the secret in command arguments.
Validation: Markdown formatting and scoped rumdl/Vale checks passed. All
three pipelines were checked with a substitute command; actual CLI
execution was unavailable.
Document the `sandbox.fuse` setting and the `sandboxOptions.fuse`
environment option so users can control FUSE filesystem access. Explain
the default, how the two controls interact, which sandboxes support
FUSE, and why changing a setting leaves existing sandboxes unchanged.
Validation: Markdown formatting and scoped rumdl/Vale checks pass.
Runtime verification was unavailable because `sbx` is not installed;
release inclusion still needs confirmation before publication.
Explain how to adopt a matching local sandbox when lost environment
records prevent attachment. Clarify that adoption requires interactive
confirmation, is separate from plan approval, and makes the sandbox
eligible for removal with `sbx env rm`.
Validation: scoped Markdown and Vale checks pass. Runtime recovery was
not exercised because `sbx` is unavailable. Release availability remains
unconfirmed.
Update the base-image reference, v2 kit guidance, and Mistral Vibe
example to use the published shell base images. Distinguish these images
from the shell kit so users choose the appropriate base for custom
workloads.
Validation: Scoped Markdown and Vale checks passed. Verified image
publication and the Docker-enabled image’s user and tools; the full Vibe
sandbox workflow was not rerun.
Update the environment file guide to explain that interactive `sbx env
exec` can offer to create a missing sandbox through the normal plan
approval and creation process. Clarify when lifecycle commands run and
why automation must create the sandbox first.
Validation: scoped Markdown and Vale checks passed with no findings.
Runtime examples were not run because `sbx` was unavailable.
Document how to mount additional sandbox workspaces at a chosen path
with the CLI or an environment file. Include target restrictions and
clarify that mounting at the host path remains the default.
Validation: Formatting and scoped Markdown and Vale checks pass for all
four changed pages. CLI examples were not run because `sbx` was
unavailable.
Explain how `sbx policy ls` displays the implicit deny fallback in
global and sandbox summaries. Clarify that the fallback applies when no
policy decides a request and is excluded from explicit deny host counts.
Validation: scoped Markdown and Vale checks passed. CLI examples were
not run because `sbx` was unavailable.
Add `agent-context@2` to the kit capability support table so kit authors
can check local support and cloud profile restrictions. Cloud sandboxes
use one workload profile in `/home/agent`, with mixin guidance written
into that profile.
Release availability is unconfirmed, so the row is marked unreleased.
Validation: scoped Markdown and Vale checks pass; specification link
verified. Runtime examples were not run because `sbx` was unavailable.
Document how to set `entrypoint` and `cmd` in an environment file and
replace default arguments with `sbx env run --`. Explain how these
settings merge, apply to existing sandboxes, and affect cloud sessions
so users can choose repeatable launch commands.
Validation: scoped Markdown formatting and lint passed with no findings;
checked the example command output locally. Sandbox runtime verification
was not performed.
Document `sbx run --no-progress` in the CI and headless guide so scripts
can suppress creation progress while retaining command results,
including detached sandbox IDs.
Validation: Markdown formatting and scoped rumdl/Vale lint passed.
Implementation and regression tests were reviewed; test execution was
blocked by the installed Go version.
Document how cloud file transfers handle symbolic links and skip empty
directories. The transfer guidance explains when to use `-L` and that
directory downloads skip symbolic links even with that flag.
Validation: Markdown formatting and scoped rumdl/Vale lint passed with
no findings. Live cloud transfers were not tested.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Summary
The security overview treated domain matching as a way to add users and
ended in a card grid. It now describes each sign-in and access option,
and points to the access token, provisioning, and roles pages.
@netlify /security/
Preview: https://deploy-preview-26520--docsdocker.netlify.app/security/
Generated by Cursor Grok
Co-authored-by: Cursor <cursoragent@cursor.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Description
Updates docs for automatic license assignment to clarify the conditions
under which members receive licenses and how licenses are provisioned.
## Related issues or tickets
https://docker.atlassian.net/browse/BILL-5235
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
## Summary
Fixes description of `dockerDaemonOptions.value` in
`configure-json-file.md`.
## Problem
In the Linux VM settings table of `configure-json-file.md`,
`dockerDaemonOptions` description stated "If `value` is set to true, it
overrides...", incorrectly implying `value` is a boolean. In reality
(and as shown in the example JSON), `value` contains a stringified JSON
configuration object (e.g., `"value": "{\"debug\": false}"`).
## Solution
Updated the table description for `dockerDaemonOptions` to accurately
reflect that `value` takes a JSON string.
Fixes#26264
Signed-off-by: reginaldalfret <reginaldalfret@gmail.com>
Correct a subject-verb agreement error ("is" to "are") in the develop.md
documentation file.
Signed-off-by: Viktor Dovhoshyia <mr.dovgoshiya@gmail.com>
## Description
Adds a "Debug a kit" page for kit authors under `customize/author`,
links it from the author index, and adds a troubleshooting entry for the
two kit logs (`/var/log/sbx-kits/<kit>/install-<n>.log` and
`/var/log/sbx-kit-startup.log`) and the `sbx -D` output.
Draft until the sbx release that ships the install logs and the `-D` kit
output is out.
## Related issues or tickets
None public.
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Move rollout planning into Organization Setup and ongoing user access
guidance into Organization Manage. Preserve the planning, pilot,
provisioning, and review workflows while linking to canonical feature
procedures. Update navigation and the pilot tutorial, and retain both
guide URLs and all seven chapter redirects.
Validation: scoped rumdl and Vale passed with no alerts; Hugo build and
focused rendered checks passed for redirects, links, retained anchors,
cards, and sidebar order. Full validation reached htmltest but its
container failed with an ARM exec format error.
Move repository credential setup and a complete build-and-push workflow
into the GitHub Actions manual. Skip registry sign-in and publishing for
pull requests, and link to specialist examples for testing, metadata,
attestations, and multi-platform builds.
Remove the standalone guide and redirect `/guides/gha/` to the manual,
preserving existing aliases.
Validation: scoped rumdl and Vale checks, Hugo build, and rendered
workflow YAML, internal links, navigation, catalog removal, and
redirects. GitHub Actions execution was not tested. Some retired heading
fragments have no destination equivalent; three setup headings retain
compatible IDs.
## Summary
Replaces the manual edits we make to this page whenever a custom-role
permission is added or renamed with a **synced data file + Hugo
shortcode**. The source of truth is `custom-role-metadata.yaml` in
`docker/iam-services`.
## What's in this PR
- **`data/custom_role_permissions.yaml`**: the upstream YAML, vendored
verbatim from iam-services `main`.
- **`layouts/_shortcodes/custom-role-permissions.html` and
`.markdown.md`**: render one section per group, with a
Permission/Description table, for both HTML and Markdown output. Cells
escape `|`. The build fails with the group and permission name if a
group, name or description is missing. The page calls it as `{{%
custom-role-permissions %}}` so the headings stay in the page table of
contents.
- **`permissions-reference.md`**: the generated region is replaced by
the shortcode call. Intro and "Next steps" stay hand-maintained.
- **`.github/workflows/sync-custom-role-permissions.yml`**:
`workflow_dispatch` (with a `ref` input) that fetches the YAML at that
ref, writes it to `data/`, and opens a PR via
`peter-evans/create-pull-request`. Site builds never need access to the
private upstream repo.
- **`.prettierignore`**: excludes the shortcode, because it emits
Markdown and Prettier's go-template plugin reflows the table.
The Node generator, hand-rolled YAML parser and generation markers are
removed.
## How the automation fires
A companion workflow in `docker/iam-services` ([PR
#1175](https://github.com/docker/iam-services/pull/1175)) triggers this
one whenever `custom-role-metadata.yaml` changes on `main`. The result
is always a **PR for review**, so nothing publishes automatically.
**Opt out of any given change:** close the generated PR; it re-opens on
the next source change.
## Testing
Built the full site with Hugo 0.163.0. HTML and Markdown output both
contain the same 32 permissions in 8 tables, the section anchors and
table of contents are intact, and removing a description fails the build
with a clear error. Prettier passes on the YAML and the workflow. The
workflow itself has not run.
## ⚠️ Provisioning needed before this runs (docs maintainers)
1. `HUB_PLATFORM_APP_ID` / `HUB_PLATFORM_APP_PRIVATE_KEY` secrets
present in this repo, with the GitHub App installed here (PR-write) and
granted contents-read on `docker/iam-services`. (Same app already used
by iam-services ↔ frontends sync.)
2. A workflow file added via a fork PR won't auto-run, so a maintainer
needs to land/enable it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Description
Mention answering questions using official Docker documentation
alongside the existing Dockerfile and Compose examples in the Docker
Skills introduction. Keep the repository catalog as the place to find
individual skills and their descriptions.
## Related issues or tickets
Complements https://github.com/docker/docs/pull/26378, which advertises
Docker Skills in generated `llms.txt`.
## Reviews
Scoped rumdl and Vale checks pass with no errors, warnings, or
suggestions. `git diff --check` passes.
- [ ] Technical review
- [ ] Editorial review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Retire the two Bake guides and preserve their useful workflows in the
existing manual: Compose release overrides, grouped tests and lint
checks, artifact exports, and release/debug matrices. Redirect the guide
URLs and update inbound links.
Validation: resolved Bake configurations, runtime examples (including an
expected test failure), amd64/arm64 exports, Hugo rendering, redirects,
headings, and navigation checked. Markdown formatting passed. Scoped
lint reports pre-existing Vale findings only; full validation failed
during vendor extraction because the build ran out of disk space.
Whole-site link checks remain for CI.
The guides omit the opt-in for Git queries with older frontends.
Document client-side query resolution and its provenance representation
caveat, and link it from the Git context guide.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The variable reference omits the Bake environment lookup control.
Explain its HCL and Compose behavior, explicit value overrides, and the
continued use of Compose .env files and Buildx configuration variables.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The policy guides omit metadata from dependencies recorded in provenance.
Describe nested material inputs and depth, and show how to check the Git
repository and commit used to build a base image.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The overrides guide does not list or explain per-resource CLI overrides.
Document the supported keys, preservation of other limits, and Linux
support requirements.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
David Karlsson
Sebastiaan van Stijn
Paweł Gronowski
Craig Osterhout
Greg Mondello
Reginald Alfret V
Viktor
Manuel de la PeñaandClaude Sonnet 5
CrazyMax