The signing instructions did not account for Git changing signed file contents. Explain the signing warning and why local verification does not establish that committed bytes match.
Kit authors lacked guidance for checking local sources without a daemon or sign-in. Document offline validation and inspection, including the policy checks they skip.
## Description
Orca is an agent development environment that runs coding agents in
parallel,
each in its own git worktree. It connects to a sandbox as a plain SSH
host and
installs its own relay inside it, so this works today with no changes on
either
side, and nothing documents it yet.
The page covers the SSH target fields (including the `_default_user_`
username), the C++ compiler Orca's remote terminals need, how agent
selection
works, and credential injection. It follows the shape of the T3 Code
page.
A separate change adds a C/C++ toolchain to the full sandbox templates.
Template
images publish independently of an `sbx` release, so the manual install
here
stops being necessary as soon as the new images carry the toolchain, and
I'll
follow up to drop it once I can pull one that does.
The T3 Code page gets the same one-line change, since it documents the
same
manual install and should name the same package.
Left out deliberately: Orca also offers an "Orca-managed Node" runtime
per SSH
target, which uploads its own Node and needs no compiler at all. I have
not
tested that path against a sandbox, so it stays out until I have.
## Related issues or tickets
- https://github.com/stablyai/orca/issues/13665
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Description
The Offload CLI prints `https://docs.docker.com/go/get-offload` when an
account has no Offload access. This PR changes where that short link
goes.
- Before: `https://app.docker.com/billing/catalog`, added in #26303.
- After:
`https://app.docker.com/billing/subscription/dap/compute?returnTo=https://docs.docker.com/offload/quickstart/&ref=cli&refAction=NotEntitled`.
The new target opens the Offload checkout directly. It asks the user to
log in first, then sends them to the checkout of their personal account.
A user who already has Offload skips checkout. After checkout, the user
returns to the Offload quickstart.
`ref=cli` and `refAction=NotEntitled` tell the app-ui checkout events
that the visit came from the CLI. The checkout keeps both params on
every step through to the success page. This lets us measure the Offload
sign-up funnel from the CLI. The app-ui changes are
docker/frontends#17539 and docker/frontends#17544, and both are in
production.
## Related issues or tickets
- DCL-2208: make the Offload web sign-up funnel measurable from end to
end.
- #26303 added the current `/go/get-offload/` redirect.
## Reviews
- The redirect handler (`hack/releaser/cloudfront-lambda-redirects.js`)
already supports targets with a query string, for example the `utm_*`
targets in the same file. It also appends any query params on the
incoming request.
- The checkout accepts `returnTo` only for HTTPS addresses on
`docker.com` hosts, so the quickstart address is accepted.
- To test after deploy, open `https://docs.docker.com/go/get-offload/`
while logged in to Docker. You land on the Offload checkout, and the
address has `ref=cli`.
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Summary
Replace the two JIT sign-in diagrams with one Mermaid flowchart, and
retitle the sections so setup, disable, and re-enable are distinct
tasks.
Agent readiness scores increased to 98, up from 94 for the live doc.
@netlify /security/provisioning/just-in-time/
Preview:
https://deploy-preview-26370--docsdocker.netlify.app/security/provisioning/just-in-time/
Generated by Cursor Grok
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Description
Add Docker Skills to the discovery links near the top of generated
`llms.txt`, and point the MCP link to
`https://ai-backend-service.docker.com/mcp` for direct access to the
Docker RAG server.
Changes the Hugo template only; the generated file is not checked in.
## Reviews
Verified the skills page returns HTTP 200 and the MCP endpoint
initializes as `gordon-rag`. Rendered the updated template with Hugo in
a minimal site and confirmed both discovery links appear in the
generated header. `git diff --check` passes. A full docs-site build was
not run.
- [ ] Technical review
- [ ] Editorial review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Documentation updates can be technically accurate yet unnecessary,
duplicated, or poorly placed. Update research to justify an edit through
the reader's task and a specific documentation gap, write to integrate
it into the existing page, and review-changes to assess reader value,
placement, and flow.
Keep the guidance in the existing skills, without a required reporting
template. Each skill update has its own commit.
Markdown checks pass; Vale reports only pre-existing findings outside
the edited lines. Skill validation passes after excluding unchanged
Claude-specific metadata unsupported by the Codex validator.
Generated by Codex
<!--Delete sections as needed -->
## Description
Adds a Mac troubleshooting topic for containers that can reach the
internet but not devices on the local network (LAN). The cause is Docker
Desktop not having the macOS **Local Network** permission: macOS then
blocks container traffic to devices on the local network, including the
router, while internet traffic still works. The fix is turning on Docker
in **System Settings** > **Privacy & Security** > **Local Network**,
which takes effect immediately, without restarting Docker Desktop.
Also adds a short **Local Network permission** section to the Mac
permission requirements page that links to the new topic, since that
page didn't mention it.
**Verified** on macOS 26.7 / Docker Desktop 4.92.0 by toggling Local
Network for Docker:
- Off: containers couldn't reach LAN peers or the default gateway (ping,
TCP, UDP DNS), while the internet and `docker pull` kept working.
- On: access came back immediately, on the same backend process, without
restarting Docker Desktop.
- **On a fresh install, macOS prompts for the Local Network permission,
so users who hit this have most likely denied that prompt at some
point.**
## Related issues or tickets
- https://github.com/docker/desktop-feedback/issues/636
## Reviews
- [ ] Technical review @mat007
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
Generated reference pages without modification dates appeared in the sitemap with lastmod set to 0001-01-01. Only render lastmod when the page has a nonzero date.
## Description
Fixes#26385.
Correct the incomplete sentence in the Compose variable interpolation
guide so the relationship between `.env` variables and container
environment variables is clear.
## Validation
- `git diff --check`
- Scoped repository lint was unavailable because the pinned local
dependencies are not installed.
## Summary
Custom secret injection is limited to HTTP request headers, but the
credentials page recommended it for secrets in request bodies and
described replacement anywhere in a request. Remove that use case and
clarify the header-only restriction.
@netlify /ai/sandboxes/configuration/credentials/
Generated by Codex
## Description
Explain how the generated Kits section points agents to each kit's
guidance, including packaged context files under
`/usr/share/sandbox/kit/<stem>/` and the location of inline
instructions.
@netlify /ai/sandboxes/customize/use-kits/
Generated by Codex
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Summary
The OIDC connection docs didn't say how many connections an organization
can have. This adds a **Connection limits** section to the OIDC
connections overview: the maximum per subscription (Team 10, Business
100), which connections count toward the limit, what happens at the
limit, and the five-rulesets-per-connection limit. The rulesets page
links to the new section.
@netlify /security/authentication/oidc-connections/
Generated by Cursor
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: erikengervall <5392475+erikengervall@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Document `sbx mcp unload` for removing a server from a running sandbox
without restarting the agent. Explain how to reload it, distinguish
unloading from removing its registration, and describe what happens
after unloading all static servers.
Validation: Markdown and style checks pass.
Generated by Codex.
## Description
Updates the [custom role permissions
reference](https://docs.docker.com/security/roles-and-permissions/custom-roles/permissions-reference/)
to match the permissions available when creating a custom role:
- **Licensing (new section):** "Manage licenses" lets a custom role
assign and revoke member licenses and manage auto-assign rules without
org ownership. It doesn't include purchasing or changing the number of
licenses. Added in docker/iam-services#1173 (BILL-5010).
- **DHI:** adds "Manage customizations", which was available in custom
roles but missing from the reference.
- **Cloud Sandboxes (new section):** adds "Use Cloud Sandboxes" (renamed
from "Use sandboxes" in docker/iam-services#1172).
Names and descriptions match `custom-role-metadata.yaml` in
iam-services. The page description, keywords, and intro are updated to
list the new areas.
## Draft until
- [ ] docker/iam-services#1173 is merged and deployed, so the Licensing
permission is visible in the custom roles UI.
## Related issues or tickets
- BILL-5010
- docker/iam-services#1173
- docker/iam-services#1172🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Summary
Adds links from each unit in the Top up your plan table on the
subscription and billing overview to the docs that cover managing that
entitlement (seats, licenses, Build Cloud minutes, DHI repositories, and
consuming domains).
Generated by Cursor
Made with [Cursor](https://cursor.com)
Co-authored-by: Cursor <cursoragent@cursor.com>
Short link for the Harbor + Docker Sandboxes integration, used in
Harbor's docs. Points to the launch blog until a docs page exists.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
Noted that DAP applies the open policy to new sandboxes by default,
which differs from local sandboxes.
## Related issues or tickets
DAPSS-889
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Description
The Mistral guide uses a v2 `spec.yaml` and injects credentials only for
`api.mistral.ai`. Update it to a v3 workload descriptor and companion
Dockerfile, with a pinned Vibe 2.25.8 installation and credential
injection for the inference, account, and managed-config hosts.
Keep the build-and-run walkthrough and add a FastAPI repair exercise
using the published community kit. Include three screenshots showing the
credential placeholder, Vibe's repair summary, and the model menu.
Readers verify the repair with pytest inside the sandbox and a Git diff
from the host repository.
## Validation
- Formatted and linted the changed guide with repository-pinned rumdl
and `scripts/lint.sh`: zero errors, warnings, or suggestions
- Validated the embedded descriptor against the upstream v3 JSON schema
and checked the three literal network hosts and authorization mappings
- Checked front matter, internal links, screenshot paths, and the public
sample configuration
- Ran fresh Gemini reader and technical reviews through Pi in SBX, with
tools, skills, and prior context disabled; fixed the findings and
received final READABLE and PASS verdicts
- Screenshots are from the interactive Vibe 2.25.8 sample; the earlier
sample run used sbx 0.46.0-rc5
Full Docker-based site validation and a rebuild of the tutorial kit
remain pending: the host Docker engine was unavailable. Schema and prose
checks do not establish image-build or runtime success.
## Reviews
- [x] Technical review through Gemini, plus descriptor schema validation
- [x] Editorial review through Gemini and local prose/lint checks
- [ ] Product review
---------
Signed-off-by: Oleg Šelajev <shelajev@gmail.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
The API reference layout loaded Redoc from the `latest` CDN URL, which
now serves Redoc 3.0.0. That bundle is an ES module that uses
import.meta, so the classic script tag fails with "Cannot use
'import.meta' outside a module" and the Engine, Hub, and Registry API
pages render blank. Pin to the 2.x UMD build.
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
## Description
Built-in agent names select v2 kits, while published v3 workloads such
as `sbx/claude` collide with those names. This change recommends v3,
maps built-in agents to published v3 workloads with distinct names, and
shows compatible CLI, kit set, and environment-file examples. The
environment-file guide starts with a built-in v2 agent and links to a
separate v3 workflow.
Compatibility, capability requirements, and migration steps each live on
the page where readers need them.
Scoped Markdown and Vale checks pass. OCI manifests verify the v2
Playwright mixin and the published v3 references; v0.48.0
agent-registration and environment kit-resolution tests pass. A full
sandbox launch was unavailable because Docker sign-in is required in
this workspace.
@netlify /ai/sandboxes/customize/use-kits/
Generated by Codex
The Console getting started page ended at sandbox launch. Expand it into
a complete first session: review a public sample project with Claude
Code, inspect and save the result, optionally connect VS Code or Cursor
over SSH, and pause or delete the sandbox.
Preserves the sandbox options reference and existing heading anchors.
The platform overview remains the gateway to concepts; use-case guides
remain separate in #26321.
Formatting, scoped Markdown and Vale lint, Hugo build, and all 19
internal links passed. This remains a draft pending live Console, cloud
SSH, and editor verification.
@netlify /agentic-platform/get-started/
[Preview the
walkthrough](https://deploy-preview-26339--docsdocker.netlify.app/agentic-platform/get-started/)
Generated by Codex
## Summary
Update the Sandbox documentation for the v0.48.0 CLI refactor: renamed
flags, settings commands, terminal output, structured output, and
non-interactive confirmations. Add a migration reference for scripts and
CI workflows, with a [**Copy as prompt**
button](https://deploy-preview-26314--docsdocker.netlify.app/ai/sandboxes/workflows/automation/#update-scripts-for-v0480)
that copies agent instructions and the section Markdown.
This PR targets `main` independently of the other PRs in the sbx/v0.48.0
milestone. It keeps the generated reference import separate from
documentation edits:
- Vendor the 120 generated CLI YAML files
- Update command examples and guidance. Historical release notes retain
their original command spellings.
The other milestone PRs cover separate release features; this PR covers
the CLI migration.
@netlify /ai/sandboxes/workflows/automation/
Generated by Codex
Several sandbox feature guides omit supported tasks or describe them
inaccurately. This change fills those gaps in the documentation for
released Sandboxes v0.47.0 and organizes the additions around the tasks
readers need to complete.
- MCP: document DHI registration after the other server inputs, make
OAuth client changes a focused maintenance task, and place resource
overrides after normal OAuth setup.
- Environment files: consolidate file placement and write protection
after the first setup example, and explain plan output before listing
its symbols.
- Cloud: separate saving and reusing templates, importing local
templates, and customizing with kits. Explain capture modes beside the
relevant operations.
- Skills: correct import precedence, include OpenCode, and explain
skipped linked dependencies after the import command.
- Kits v2: correct the downloaded archive formats in the command entry
and put provenance inspection with signing and verification. Omit OCI
storage details that don't help complete these tasks.
Behavior was checked against the v0.47.0 source. In particular,
replacing an OAuth client secret does not clear its previous identity
binding; the recovery task retains the required reset and tells readers
to verify the intended client and provider first.
Validation: scoped Markdown and Vale lint passed, the full Hugo
development build passed, and checks of the five rendered guides
confirmed complete code blocks, visible placeholders, plan indentation,
valid same-page anchors, skills import order, and the revised task
headings. Changes are committed separately by issue. The v0.48 migration
remains in #26314.
```release-note
NONE
```
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
David Karlsson
CrazyMax
Manuel de la PeñaandClaude Opus 5
Arun AllamsettyandClaude Opus 5.5
Maria Ines Parnisari
docker-tools-robot
Paweł Gronowski
Alexa KristensenandCursor
Salman RanaandAllie Sadler
Niels Kaspers
Greg MondelloandClaude Opus 5.5
Sebastiaan van Stijn
Mathieu Champlon
Sohan PatilandClaude Opus 5.5
Craig Osterhout
Oleg ŠelajevandDavid Karlsson
Usha MandyaandClaude Opus 5.5