Vendor the checked-in CLI YAML from Docker Sandboxes release/v0.51 at
7d55286de0c7. This updates command help, adds `sbx policy check http`,
and replaces seven agent-specific create pages with redirects to `sbx
create`.
Validation: full site build with Hugo 0.169.0; upstream byte-for-byte
comparison; all 115 command pages, reference links, and seven redirects
checked; template formatting and whitespace checks passed.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Summary
Replaces the manual edits we make to this page whenever a custom-role
permission is added or renamed with a **synced data file + Hugo
shortcode**. The source of truth is `custom-role-metadata.yaml` in
`docker/iam-services`.
## What's in this PR
- **`data/custom_role_permissions.yaml`**: the upstream YAML, vendored
verbatim from iam-services `main`.
- **`layouts/_shortcodes/custom-role-permissions.html` and
`.markdown.md`**: render one section per group, with a
Permission/Description table, for both HTML and Markdown output. Cells
escape `|`. The build fails with the group and permission name if a
group, name or description is missing. The page calls it as `{{%
custom-role-permissions %}}` so the headings stay in the page table of
contents.
- **`permissions-reference.md`**: the generated region is replaced by
the shortcode call. Intro and "Next steps" stay hand-maintained.
- **`.github/workflows/sync-custom-role-permissions.yml`**:
`workflow_dispatch` (with a `ref` input) that fetches the YAML at that
ref, writes it to `data/`, and opens a PR via
`peter-evans/create-pull-request`. Site builds never need access to the
private upstream repo.
- **`.prettierignore`**: excludes the shortcode, because it emits
Markdown and Prettier's go-template plugin reflows the table.
The Node generator, hand-rolled YAML parser and generation markers are
removed.
## How the automation fires
A companion workflow in `docker/iam-services` ([PR
#1175](https://github.com/docker/iam-services/pull/1175)) triggers this
one whenever `custom-role-metadata.yaml` changes on `main`. The result
is always a **PR for review**, so nothing publishes automatically.
**Opt out of any given change:** close the generated PR; it re-opens on
the next source change.
## Testing
Built the full site with Hugo 0.163.0. HTML and Markdown output both
contain the same 32 permissions in 8 tables, the section anchors and
table of contents are intact, and removing a description fails the build
with a clear error. Prettier passes on the YAML and the workflow. The
workflow itself has not run.
## ⚠️ Provisioning needed before this runs (docs maintainers)
1. `HUB_PLATFORM_APP_ID` / `HUB_PLATFORM_APP_PRIVATE_KEY` secrets
present in this repo, with the GitHub App installed here (PR-write) and
granted contents-read on `docker/iam-services`. (Same app already used
by iam-services ↔ frontends sync.)
2. A workflow file added via a fork PR won't auto-run, so a maintainer
needs to land/enable it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Summary
- Stop mounting Docker Agent Community on docs.docker.com; keep
technical sections and Guides mounted.
- Sync the module pin and generated vendor files to Docker Agent
v1.152.0, which includes docker/docker-agent#4618 (`cc52bd76`).
- Redirect the Community root, Contributing, and Resources to GitHub
Pages. Preserve the three technical-page redirects through upstream
aliases.
## Merge order
Depends on #26451 for Go 1.27. This branch includes its commit by
ancestry; both PRs target `main`. Merge #26451 first.
Coordinate with the docs team: this supersedes the sync in #25913. Draft
#25919 remains suspended and compatible. Neither bot PR was edited or
closed.
## Redirects
| Former `/ai/docker-agent/` path | Destination |
| --- | --- |
| `community/` |
https://docker.github.io/docker-agent/community/contributing/ |
| `community/contributing/` |
https://docker.github.io/docker-agent/community/contributing/ |
| `community/resources/` |
https://docker.github.io/docker-agent/community/resources/ |
| `community/telemetry/` | `/ai/docker-agent/configuration/telemetry/` |
| `community/opentelemetry/` |
`/ai/docker-agent/configuration/opentelemetry/` |
| `community/troubleshooting/` |
`/ai/docker-agent/guides/troubleshooting/` |
The GitHub Pages `/community/` root returns 404, so the former section
root redirects to Contributing.
## Validation
CI passes, including build, vendor validation, and redirect tests. Local
checks passed for all 9 redirect unit tests, six generated mappings, and
24 CloudFront cases covering trailing slashes and query strings.
## Description
Adds public documentation for `GET /v2/auditlogs/governance/{org_name}`
and aligns the guide and OpenAPI reference with merged data-platform
main (`66bc70971`), including
[docker/data-platform#2711](https://github.com/docker/data-platform/pull/2711)
and
[docker/data-platform#2712](https://github.com/docker/data-platform/pull/2712).
- Documents raw Organization Access Token authentication and the View
audit logs permission.
- Covers the 25-event default, 100-event page cap, 30-day request
window, and cursor-preserved time bounds. Text search can use the
default window.
- Documents the API and gateway organization limits of 5 requests per
second and the gateway limit of 600 requests per minute per source IP.
Clients and tokens share the organization limits, and each pagination
request counts.
- Updates the structured application 429 example to `limit: 5`,
`window_seconds: 1`, and `retry_after_seconds: 1`.
- Keeps Retry-After optional: application responses include it when the
reset time is known, while gateway responses can omit it and use a
different body. The chart-owned Lua policy was removed in
[docker/data-platform#2725](https://github.com/docker/data-platform/pull/2725);
these docs do not promise gateway header translation.
- Covers request deadlines, search timeouts, and retryable dependency
failures, with links to the audit record reference and
subscription/access-token pages.
## Release status
The production route and gateway policies are enabled in the merged
configuration. One unauthenticated GET to
`https://api.docker.com/v2/auditlogs/governance/vonwig?page_size=1`
returned HTTP 401 with `{"error":"missing or malformed Authorization
header"}`, confirming public routing and missing-token rejection.
Before publishing, confirm the OAT View audit logs permission is
available in Docker Home and record authorized production
query/pagination, organization/IP throttling, retry behavior, and
monitoring validation. No authenticated request or rate-limit load test
was performed in this update. Merged configuration and a 401 response do
not establish those outcomes.
## Validation
- Scoped rumdl and Vale checks: passed with 0 errors, warnings, or
suggestions.
- Prettier check for the OpenAPI YAML: passed.
- OpenAPI 3.0 validation: passed using @apidevtools/swagger-parser
10.1.0.
- Public server and application 429 example checked against the merged
production values.
- `git diff --check`: passed.
- Full Hugo rendering and rendered link validation were not run; PR CI
and the deploy preview still need review.
Documents six user-facing changes in sbx 0.50: kit host mount bindings,
persistent kit volume retention, environment MCP command approvals and
ownership, HTTP query restrictions, cloud sandbox inspection, and exec
exit status in automation. Each change has its own commit. Also vendors
the matching v0.50 CLI reference verbatim and regenerates the release
notes from published GitHub releases.
Kit documentation focuses on sbx usage and links to the canonical
capability definitions. Volume retention follows the 0.50
implementation; the upstream spec's main branch describes a different
storage lifecycle.
Verified against the release implementation. Scoped Markdown and prose
lint, a full Hugo build, and checks of the added internal links pass.
Related release: https://github.com/docker/sandboxes/issues/7698
Generated by Codex
## Description
The Offload CLI prints `https://docs.docker.com/go/get-offload` when an
account has no Offload access. This PR changes where that short link
goes.
- Before: `https://app.docker.com/billing/catalog`, added in #26303.
- After:
`https://app.docker.com/billing/subscription/dap/compute?returnTo=https://docs.docker.com/offload/quickstart/&ref=cli&refAction=NotEntitled`.
The new target opens the Offload checkout directly. It asks the user to
log in first, then sends them to the checkout of their personal account.
A user who already has Offload skips checkout. After checkout, the user
returns to the Offload quickstart.
`ref=cli` and `refAction=NotEntitled` tell the app-ui checkout events
that the visit came from the CLI. The checkout keeps both params on
every step through to the success page. This lets us measure the Offload
sign-up funnel from the CLI. The app-ui changes are
docker/frontends#17539 and docker/frontends#17544, and both are in
production.
## Related issues or tickets
- DCL-2208: make the Offload web sign-up funnel measurable from end to
end.
- #26303 added the current `/go/get-offload/` redirect.
## Reviews
- The redirect handler (`hack/releaser/cloudfront-lambda-redirects.js`)
already supports targets with a query string, for example the `utm_*`
targets in the same file. It also appends any query params on the
incoming request.
- The checkout accepts `returnTo` only for HTTPS addresses on
`docker.com` hosts, so the quickstart address is accepted.
- To test after deploy, open `https://docs.docker.com/go/get-offload/`
while logged in to Docker. You land on the Offload checkout, and the
address has `ref=cli`.
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Short link for the Harbor + Docker Sandboxes integration, used in
Harbor's docs. Points to the launch blog until a docs page exists.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Summary
Update the Sandbox documentation for the v0.48.0 CLI refactor: renamed
flags, settings commands, terminal output, structured output, and
non-interactive confirmations. Add a migration reference for scripts and
CI workflows, with a [**Copy as prompt**
button](https://deploy-preview-26314--docsdocker.netlify.app/ai/sandboxes/workflows/automation/#update-scripts-for-v0480)
that copies agent instructions and the section Markdown.
This PR targets `main` independently of the other PRs in the sbx/v0.48.0
milestone. It keeps the generated reference import separate from
documentation edits:
- Vendor the 120 generated CLI YAML files
- Update command examples and guidance. Historical release notes retain
their original command spellings.
The other milestone PRs cover separate release features; this PR covers
the CLI migration.
@netlify /ai/sandboxes/workflows/automation/
Generated by Codex
Monitoring guides were grouped under CI/CD, and several other guides had
categories that did not match their main purpose. Add Observability,
rename Deployment to Services & infrastructure, and move LocalStack and
Django into Testing and Languages & frameworks.
Remove the E2B workflow and integration documentation and both Ollama
application guides. Remove E2B navigation and promotional links.
Redirect former E2B URLs to Docker Sandboxes and former Ollama guide URLs
to Docker Model Runner.
The Build Cloud, Compose, Scout, Testcontainers Cloud, and
container-supported development guides mostly repeat product benefits
and introduce videos instead of teaching distinct tasks.
Remove these five guides and their unused images, update incoming links,
and redirect all former page and chapter URLs to the relevant product
docs or hands-on lab. Keep both administration guides.
## Description
Add Offload shortcuts for the product page, billing catalog, and
documentation:
- `/go/offload` redirects to
https://www.docker.com/products/docker-offload/.
- `/go/get-offload` redirects to https://app.docker.com/billing/catalog.
- `/go/cloud-flag/` redirects to https://docs.docker.com/offload/.
## Related issues or tickets
DCL-2119
## Reviews
Validated with all nine existing redirect-handler tests and `git diff
--check`. All three shortcuts accept URLs with or without a trailing
slash. The product and documentation pages return HTTP 200; the billing
catalog redirects unauthenticated visitors to login with the catalog as
the return destination.
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
## Description
Documents the user-facing changes in Docker Sandboxes v0.47.0 and
updates the CLI reference.
- `sbx run --rm` removes the sandbox when the agent exits, for local and
cloud sandboxes.
- `sbx run --detached` keeps a local sandbox running after its sessions
end.
- Kits can declare the `long-running@1` capability to keep their sandbox
running.
- `sbx move` to the cloud applies the kit's network rules.
- MCP authorization requests `offline_access` with default scopes, so
servers can issue refresh tokens.
- UDP to local-network destinations is blocked regardless of network
policy.
- `sbx --cloud ttl` reports stopped sandboxes as stopped instead of
expired.
- The CLI reference is updated for v0.47.0.
@netlify /ai/sandboxes/usage/
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Summary
Add the Docker Skills launch omitted from the September curation in
#26195 and update the featured ranking.
## Selected entries
- Docker Skills — Give coding agents guidance with Docker Skills
(#26169)
## Curation notes
Retained all seven existing entries and expired none. The retained Run
agents without mounting host files entry remains in the timeline but is
no longer featured, keeping the five featured slots for the
highest-ranked launches.
Generated by Codex
## Summary
Extend the Docker Docs launch timeline through September 27 and feature
three Docker Sandboxes launches.
## Selected entries
- Docker Sandboxes — Run sandboxes on Docker-managed cloud
infrastructure (#26142, #26157, #26158, #26181)
- Docker Sandboxes — Manage cloud sandboxes with the API and TypeScript
SDK (#26142, #26168)
- Docker Sandboxes — Compose sandbox environments with kits v3 (#26065,
#26157)
## Curation notes
Retained four entries and removed six entries published before the new
August 29 window. No retained entry content or sources changed.
Docker Desktop 4.92, DHI webhook metadata, API reference migrations, and
the Desktop Kubernetes command references did not meet the threshold for
a Docker-wide launch highlight.
Generated by Codex
## Summary
Refresh the vendored Sandboxes cookbook and OpenAPI reference from
upstream.
Removes standalone MCP gateway start/stop documentation, imports
upstream authentication and timeout examples, auto-resume readback
guidance, and network-policy selector updates, and regenerates the API
presentation data.
@netlify /ai/sandboxes-api/cookbook/give-a-sandbox-an-mcp-gateway/
Generated by Codex
API generation introduced in #26048 added roughly five minutes to site
builds: median successful main-branch build-workflow duration rose from
4m 05s to 8m 48s across September 3–25. The pre-build command took 4m
41s–4m 53s in each of four jobs on the merge commit.
Vendor the generated presentation model in `data/api-reference.json`,
mark it as generated, and let Docker, Netlify, and local Hugo builds
consume it directly. Keep the existing rendered-output checks.
Move generator tests, strict spec validation, and a byte-for-byte
regeneration check into `docker buildx bake validate-api-reference`,
inheriting the shared Docker base stage. The target uses the pinned
Vacuum release binary with Dockerfile ADD checksum verification and
archive extraction instead of compiling Vacuum from source. The existing
build workflow runs this target alongside the other validation matrix
entries. Only this matrix entry is advisory; its failures do not block
site builds or deployment.
Validated locally with the Docker target, rejection of deliberately
stale data, repeatable generation across directories, a production Hugo
build and verification of 453 API HTML/Markdown page pairs, workflow
syntax checks, and scoped documentation lint. The prebuilt-binary CI
check passed in 1m 40s, down from 5m 15s with source compilation. Remote
layer-cache settings were subsequently removed; local Go cache mounts
remain.
Generated by Codex
## Description
Add cloud Sandboxes documentation for sbx v0.45.0, covering credentials,
network policy, lifecycle, environment files, and transfers between
local and cloud sandboxes. Document named sandbox reuse and resume,
resource sizes and platform selection, custom secrets, move behavior,
and local UDP guidance.
Link to the canonical Docker Agentic Platform signup, billing, and
Console MCP instructions. Keep CLI sign-in, access checks, and cloud
credential setup in the Sandboxes guides.
This PR also vendors the CLI reference including `sbx move`, and aligns
timeout and move guidance with it. Kits v3 and API/SDK documentation are
handled separately.
Validation: scoped Markdown and Vale checks and a full Hugo build
passed. Cloud and Agentic Platform guides passed rendered internal link
and anchor checks, including the canonical signup page's discovery. The
earlier CLI import verified all 119 vendored files against upstream
byte-for-byte and checked 1,083 rendered CLI-reference links and
anchors. Behavior was checked against source; live cloud workflows and
checkout were not exercised.
@netlify /ai/sandboxes/cloud/
Generated by Codex
Add v3 kit documentation for Docker Sandboxes: concepts, usage,
authoring, and kit sets. Link to the upstream specification for
reference details and retain v2 guidance.
Validation: Markdown/style checks, Hugo build, internal links, and
example build checks passed.
Closesdocker/sbx-releases#569
@netlify /ai/sandboxes/customize/
## Description
`docker desktop kubernetes status` and `docker desktop kubernetes
reset-cluster` are implemented in desktop-cli but had no reference page:
`data/cli/desktop` was missing their YAML, which is what the reference
pages are generated from. Adds both files and lists them in the parent
command's `cname`/`clink` (also fixes `clink` pointing at a nonexistent
`docker_desktop_engine_images.yaml`).
## Related issues or tickets
https://docker.atlassian.net/browse/DDB-567
## Reviews
- [ ] Technical review
- [ ] Editorial review
## Summary
Prototypes a task-first Get started experience organized around three
short journeys:
- Containerization: run a container and application stack, build an
image, and share it.
- AI development: move an existing full-autonomy coding-agent workflow
into a disposable Docker Sandbox.
- Administration: invite a pilot user, apply a Docker Desktop policy,
and verify the managed experience.
The change replaces the existing Get started landing content with a
compact journey selector, adds direct installation paths for Docker and
Docker Sandboxes above the tutorials, adds the tutorials as a
collapsible sidebar group, and updates homepage and `llms.txt` discovery
paths. The container and sandbox tutorials include focused next steps
into relevant concept and manual pages.
The superseded Introduction series and its unused images are removed.
Its published routes and legacy aliases, including the workshop routes
consolidated on `main`, redirect to the replacement container tutorial
or the Get Docker page. Inbound documentation links point to the new
tutorial.
The existing Docker concepts content remains available while this
direction is evaluated.
@netlify /get-started/
## Deploy preview
- [Get started landing
page](https://deploy-preview-25986--docsdocker.netlify.app/get-started/)
- [Containerization
tutorial](https://deploy-preview-25986--docsdocker.netlify.app/get-started/tutorials/run-an-app/)
- [AI agent
tutorial](https://deploy-preview-25986--docsdocker.netlify.app/get-started/tutorials/run-an-agent/)
- [Administrator
tutorial](https://deploy-preview-25986--docsdocker.netlify.app/get-started/tutorials/admin-set-up/)
Generated by Codex
---------
Co-authored-by: Codex <noreply@openai.com>
The checked-in sbx command reference predates the v0.42.0 release and omits or misstates its command surface.
Replace data/sbx_cli with the generated v0.42.0 reference while preserving the corrected private-network example from PR #26004.
Co-Authored-By: Codex <noreply@openai.com>
# To dos
~- Evaluate _index pages and standardize across account + admins
category~
~- Edit weights of topics~
- Notify TSEs, other stakeholders
- TW sign off
## Summary
This PR restructures the Platform documentation into a clearer Accounts,
Security, and Subscription and billing information architecture, with
aliases so existing URLs keep working.
Work from these PRs was merged into this feature branch:
- #25957 (Security IA)
- #25960 (Accounts and Admin)
- #25981 (Subscription and billing)
### Accounts
- Moves organization, company, and admin content under Accounts.
- Splits individual-account docs into their own subsection.
- Removes the standalone Admin section; those pages now live under
Accounts.
### Security
- Publishes Security at `/security/`, matching other Platform sections.
- Groups authentication (SSO, 2FA, OIDC), access tokens, provisioning,
and roles under Security.
- Leaves Enterprise Hardened Desktop and related enterprise security
docs under Enterprise.
- Restores shipped Hardened Desktop and security FAQ URLs so they match
`main`.
### Subscription and billing
- Merges Subscription and Billing into a single Subscription and billing
section.
- Drops the extra subcategory wrappers and nests billing tasks under
Manage.
- Shortens the billing details sidebar label.
### FAQs
- Consolidates Platform FAQs onto four pages: Accounts, Security,
Subscription and billing, and Platform.
- Folds leftover general, container, and network/VM security FAQs into
Platform FAQs.
- Folds SSO enforcement FAQs into the SSO FAQ.
- Templates FAQ pages with H2 topics and H3 questions, and limits the
table of contents to H2.
### Navigation and follow-ups
- Renames the manuals sidebar group from Platform to Accounts and admin,
and updates the manuals landing heading and copy to match.
- Fixes the MSI install Settings Management link after the security path
move.
- Updates CODEOWNERS, the labeler, and in-repo links to the new paths.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
David Karlsson
Craig Osterhout
Allie Sadler
Greg MondelloandClaude Opus 4.8
Arnaud Héritier
Brian Refsdal
Arun AllamsettyandClaude Opus 5.5
Maria Ines Parnisari
Alexa KristensenandCursor
Sohan PatilandClaude Opus 5.5
Mark HandClaude Opus 5.5
docker-tools-robot
Nicolas Beck
Mathieu Champlon
github-actions[bot]
CrazyMax