## Description
Add Offload shortcuts for the product page, billing catalog, and
documentation:
- `/go/offload` redirects to
https://www.docker.com/products/docker-offload/.
- `/go/get-offload` redirects to https://app.docker.com/billing/catalog.
- `/go/cloud-flag/` redirects to https://docs.docker.com/offload/.
## Related issues or tickets
DCL-2119
## Reviews
Validated with all nine existing redirect-handler tests and `git diff
--check`. All three shortcuts accept URLs with or without a trailing
slash. The product and documentation pages return HTTP 200; the billing
catalog redirects unauthenticated visitors to login with the catalog as
the return destination.
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
The API reference banner kept its light background when links switched to light colors in dark mode. Add dark background, border, and text colors matching the note callout palette.
## Description
Documents the user-facing changes in Docker Sandboxes v0.47.0 and
updates the CLI reference.
- `sbx run --rm` removes the sandbox when the agent exits, for local and
cloud sandboxes.
- `sbx run --detached` keeps a local sandbox running after its sessions
end.
- Kits can declare the `long-running@1` capability to keep their sandbox
running.
- `sbx move` to the cloud applies the kit's network rules.
- MCP authorization requests `offline_access` with default scopes, so
servers can issue refresh tokens.
- UDP to local-network destinations is blocked regardless of network
policy.
- `sbx --cloud ttl` reports stopped sandboxes as stopped instead of
expired.
- The CLI reference is updated for v0.47.0.
@netlify /ai/sandboxes/usage/
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Doc that adds some context about JIT vs SCIM, per SME resources. Makes
updates to overview docs, troubleshooting, and FAQs. Also includes a
freshness pass from tier 1 and tier 2 review agents.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary
Late September accounts and admin changes were missing from the release
notes. Add the Agentic Platform checkout skip, the team page after
create, the member CSV Licenses column, and the support form Legal
topics.
Co-authored-by: Cursor <cursoragent@cursor.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
sbx --cloud ttl no longer reports a stopped sandbox as expired. Explain
that resuming starts a new time-to-live period and describe the
stopped and ttl_paused JSON fields.
Source: docker/sandboxes#6388
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
UDP to multicast, link-local, unspecified, and broadcast destinations
is dropped before policy evaluation, so no allow rule can permit it.
Explain the effect on discovery protocols and how the network log
reports these connections.
Source: docker/sandboxes#5875
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
When sbx uses recorded default or resource-required scopes, it also
requests offline_access if the authorization server advertises it, so
the server can issue a refresh token. Explicit --scope values are
requested as given.
Source: docker/sandboxes#6284
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
sbx move --to cloud now applies the sandbox's kit or agent network
rules, as sbx --cloud create does. Rules added locally still don't
transfer. Correct the move and cloud network policy pages, which said
no local rules apply.
Source: docker/sandboxes#6707 (backported as #6814)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain how a kit declares long-running@1 to keep its sandbox running
after sessions end, how required and optional entries behave, and that
cloud sandboxes and sbx kit add can't provide it.
Source: docker/sandboxes#6710
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain that sbx run --detached keeps a local sandbox running after its
sessions end, and that running it against an existing sandbox switches
that sandbox to detached mode permanently.
Source: docker/sandboxes#6600
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain that --rm removes a local or cloud sandbox when the agent
session exits, when a reattached sandbox is kept, and why --rm can't be
combined with --detached or --detach-keys.
Source: docker/sandboxes#6601
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
See commit message(s).
Just fixes a small hiccup on the docs! It makes it sounds like Debian
comes with ufw but it doesn't.
> nftables is the default and recommended firewalling framework in
Debian…
>
> It is recommended to run
[?](https://wiki.debian.org/firewalld)firewalld…
>
> \- [Debian Wiki: nftables](https://wiki.debian.org/nftables)
Just to confirm, I also installed Debian on a VM and checked if ufw was
present, and indeed it wasn't. This was run on a fresh express Debian
install:
```txt
root@debian13-uni:/home/seth# ufw
bash: ufw: command not found
root@debian13-uni:/home/seth#
```
- [ ] Technical review
- [x] Editorial review
- [ ] Product review
I'm not sure if it did in the past, but as of Debian Trixie (13) ufw is certainly not preinstalled. Debian comes with nftables and recommends firewalld as a frontend for it.
ufw is available on Debian repos and is documented on the wiki, but not preinstalled.
See: https://wiki.debian.org/nftables
Drops the staging-only VWO Async SmartCode snippet from the head partial
and the matching analytics.vwo account param. VWO is no longer used;
this was left over from the 2024 A/B testing trial on docs-stage.
Signed-off-by: maxcleme <maxime.clement@docker.com>
Deep validation, added important conceptual information, refresh tier 2
on setup docs for organizations
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
The 2FA section page mixed concepts with enable and disable steps, and
the same recovery-code and sign-in details appeared on more than one
page. This splits procedures onto a manage page, keeps the overview to
how 2FA works and when Docker asks for the code, and leaves the recover
page for the recovery-code and Support steps.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary
The kit docs explain published sets and direct mixin composition but
don't help readers choose between a set and an environment file. Clarify
when to use each, link to environment files from the mixin composition
instructions, and note that separately composed OCI kits need distinct
image repository names.
@netlify /ai/sandboxes/customize/
Generated by Codex
## Description
Document the audit record changes in Docker Sandboxes 0.46. Sandboxes
now writes a record when a user resolves a pending approval, records
HTTP request evaluations separately from the network connection, and
includes the enforcement mode on evaluation records.
| Page | What changed |
| --- | --- |
|
[`record-reference.md`](https://deploy-preview-26189--docsdocker.netlify.app/ai/sandboxes/governance/audit/record-reference/)
| Adds the `enforcement_mode` and `approval` fields. Fixes the approval
decisions to `AUDIT_DECISION_APPROVAL_ALLOW` and
`AUDIT_DECISION_APPROVAL_DENY`, which replace values that don't exist in
the schema. New **Enforcement modes** section. New **Approval fields**
section that covers `approval_request_id`, `grant_scope`, and how a
failed grant is recorded. Adds the `http_request` action type, a new
**HTTP request payload** section, and a sample approved HTTP request
record |
## Related issues or tickets
https://github.com/docker/sandboxes/pull/6656
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Description
The third-party mirroring guide describes image layers as stored on
`dhi.io`, which makes it unclear why the examples use Docker Hub for
images and the Scout registry for attestations.
Clarify that `dhi.io` provides access to DHI catalog images and their
signed attestations, while customer mirrors and customized images in
organization repositories are accessed through Docker Hub. This explains
why the examples copy images from Docker Hub and attestations from
`registry.scout.docker.com` into the same destination repository.
Copying only the image does not preserve its attestations.
The proxy's repository routing rejects names containing `/` and maps
accepted names into the `dhi/` namespace: [routing
implementation](https://github.com/atomisthq/dhi-proxy/blob/e47c68d6473b2b45a4aeb3be55808eee58902732/internal/proxy/middleware.go#L161-L188).
The public [image reference
documentation](https://docs.docker.com/dhi/how-to/use/#pull-run-and-reference-dhis)
also distinguishes catalog references on `dhi.io` from organization
repositories on Docker Hub.
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
## Validation
- `npx --no-install rumdl fmt content/manuals/dhi/how-to/mirror.md`
- `scripts/lint.sh content/manuals/dhi/how-to/mirror.md` with
repository-pinned rumdl 0.2.49 and Vale 3.17.0: no errors, warnings, or
suggestions
- `git diff --check`
This is a prose-only change. The mirroring commands are unchanged. A
full site build was not run.
---------
Signed-off-by: Brian Rubinton <brian.rubinton@docker.com>
David Karlsson
docker-tools-robot
Nicolas Beck
agent
Alexa KristensenandCursor
Manuel de la Peña
Allie Sadler
Reginald Alfret V
Niels Kaspers
Dave123981
Deepanshu PalandClaude
Seth Falco
Huzaifa-Asif
Craig Osterhout
Guillaume Lours
maxcleme
Brian J. Rubinton