## Description
Adds a "Debug a kit" page for kit authors under `customize/author`,
links it from the author index, and adds a troubleshooting entry for the
two kit logs (`/var/log/sbx-kits/<kit>/install-<n>.log` and
`/var/log/sbx-kit-startup.log`) and the `sbx -D` output.
Draft until the sbx release that ships the install logs and the `-D` kit
output is out.
## Related issues or tickets
None public.
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Move rollout planning into Organization Setup and ongoing user access
guidance into Organization Manage. Preserve the planning, pilot,
provisioning, and review workflows while linking to canonical feature
procedures. Update navigation and the pilot tutorial, and retain both
guide URLs and all seven chapter redirects.
Validation: scoped rumdl and Vale passed with no alerts; Hugo build and
focused rendered checks passed for redirects, links, retained anchors,
cards, and sidebar order. Full validation reached htmltest but its
container failed with an ARM exec format error.
Move repository credential setup and a complete build-and-push workflow
into the GitHub Actions manual. Skip registry sign-in and publishing for
pull requests, and link to specialist examples for testing, metadata,
attestations, and multi-platform builds.
Remove the standalone guide and redirect `/guides/gha/` to the manual,
preserving existing aliases.
Validation: scoped rumdl and Vale checks, Hugo build, and rendered
workflow YAML, internal links, navigation, catalog removal, and
redirects. GitHub Actions execution was not tested. Some retired heading
fragments have no destination equivalent; three setup headings retain
compatible IDs.
## Summary
Replaces the manual edits we make to this page whenever a custom-role
permission is added or renamed with a **synced data file + Hugo
shortcode**. The source of truth is `custom-role-metadata.yaml` in
`docker/iam-services`.
## What's in this PR
- **`data/custom_role_permissions.yaml`**: the upstream YAML, vendored
verbatim from iam-services `main`.
- **`layouts/_shortcodes/custom-role-permissions.html` and
`.markdown.md`**: render one section per group, with a
Permission/Description table, for both HTML and Markdown output. Cells
escape `|`. The build fails with the group and permission name if a
group, name or description is missing. The page calls it as `{{%
custom-role-permissions %}}` so the headings stay in the page table of
contents.
- **`permissions-reference.md`**: the generated region is replaced by
the shortcode call. Intro and "Next steps" stay hand-maintained.
- **`.github/workflows/sync-custom-role-permissions.yml`**:
`workflow_dispatch` (with a `ref` input) that fetches the YAML at that
ref, writes it to `data/`, and opens a PR via
`peter-evans/create-pull-request`. Site builds never need access to the
private upstream repo.
- **`.prettierignore`**: excludes the shortcode, because it emits
Markdown and Prettier's go-template plugin reflows the table.
The Node generator, hand-rolled YAML parser and generation markers are
removed.
## How the automation fires
A companion workflow in `docker/iam-services` ([PR
#1175](https://github.com/docker/iam-services/pull/1175)) triggers this
one whenever `custom-role-metadata.yaml` changes on `main`. The result
is always a **PR for review**, so nothing publishes automatically.
**Opt out of any given change:** close the generated PR; it re-opens on
the next source change.
## Testing
Built the full site with Hugo 0.163.0. HTML and Markdown output both
contain the same 32 permissions in 8 tables, the section anchors and
table of contents are intact, and removing a description fails the build
with a clear error. Prettier passes on the YAML and the workflow. The
workflow itself has not run.
## ⚠️ Provisioning needed before this runs (docs maintainers)
1. `HUB_PLATFORM_APP_ID` / `HUB_PLATFORM_APP_PRIVATE_KEY` secrets
present in this repo, with the GitHub App installed here (PR-write) and
granted contents-read on `docker/iam-services`. (Same app already used
by iam-services ↔ frontends sync.)
2. A workflow file added via a fork PR won't auto-run, so a maintainer
needs to land/enable it.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
## Description
Mention answering questions using official Docker documentation
alongside the existing Dockerfile and Compose examples in the Docker
Skills introduction. Keep the repository catalog as the place to find
individual skills and their descriptions.
## Related issues or tickets
Complements https://github.com/docker/docs/pull/26378, which advertises
Docker Skills in generated `llms.txt`.
## Reviews
Scoped rumdl and Vale checks pass with no errors, warnings, or
suggestions. `git diff --check` passes.
- [ ] Technical review
- [ ] Editorial review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Retire the two Bake guides and preserve their useful workflows in the
existing manual: Compose release overrides, grouped tests and lint
checks, artifact exports, and release/debug matrices. Redirect the guide
URLs and update inbound links.
Validation: resolved Bake configurations, runtime examples (including an
expected test failure), amd64/arm64 exports, Hugo rendering, redirects,
headings, and navigation checked. Markdown formatting passed. Scoped
lint reports pre-existing Vale findings only; full validation failed
during vendor extraction because the build ran out of disk space.
Whole-site link checks remain for CI.
The guides omit the opt-in for Git queries with older frontends.
Document client-side query resolution and its provenance representation
caveat, and link it from the Git context guide.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
## Description
#26452 added cards to Gordon's answers (steps, tables, notes, snippets,
follow-up questions), but shipped them off in production behind
`params.gordon.cards`. They've been on in local builds and deploy
previews, and Gordon's backend already supports them for the docs site.
This turns them on for docs.docker.com.
To roll back, set the flag back to `false`.
## Related issues or tickets
- #26452
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
The variable reference omits the Bake environment lookup control.
Explain its HCL and Compose behavior, explicit value overrides, and the
continued use of Compose .env files and Buildx configuration variables.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The policy guides omit metadata from dependencies recorded in provenance.
Describe nested material inputs and depth, and show how to check the Git
repository and commit used to build a base image.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The overrides guide does not list or explain per-resource CLI overrides.
Document the supported keys, preservation of other limits, and Linux
support requirements.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The guide only describes Git credentials for fetching Bake definitions.
Explain reuse for same-host Git contexts, automatic host selection, and
the limits when using local definitions or contexts on other hosts.
Keep the detailed explanation in the token reference.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
## Summary
The lifecycle reference lists host command environment variables without
explaining their values. Replace the list with a table covering file
merge order, path separators, sandbox name overrides, and the empty
workspace value in cloud environments. Clarify that sbx commands run by
cloud lifecycle commands inherit cloud mode and the selected endpoint.
Companion to #26393; this change can merge independently. Verified
against docker/sandboxes release/v0.49 at c5b19951af12. Scoped rumdl and
Vale checks passed.
@netlify /ai/sandboxes/configuration/environment-files/
Generated by Codex
Update the host-only registry credential description to refer to `sbx`
as a whole, covering pulls authenticated by the daemon. The credential
storage commands and scope guidance are unchanged.
Validation: Markdown formatting and scoped rumdl/Vale checks passed.
The Agentic Platform docs referenced outdated Secrets controls and
omitted steps needed to configure MCP clients, network rules, and SSH
access. This updates the navigation and task guidance from the October
23 UI audit, including sandbox restore actions, kit filters, naming and
compute selection, and delayed usage reporting.
Each of the 11 audit findings has a separate commit. Feature
availability is qualified where it varies by account. Signup
requirements and pause/process semantics remain unchanged; process
restoration still needs product confirmation.
All seven changed Markdown files passed rumdl and Vale with no errors,
warnings, or suggestions.
@netlify /agentic-platform/
Generated by Codex
## Summary
The getting-started walkthrough promised a network preset prompt on the
first sandbox run, even when policy was already configured. Explain when
the CLI prompts, document `sbx policy init balanced` for manual
initialization, and remove outdated prompt transcripts from the
walkthrough and local-policy page. Also clarify that agent kits can add
model-provider allowances under Locked Down.
@netlify /ai/sandboxes/get-started/
Generated by Codex
<!--Delete sections as needed -->
## Description
Reduce time to stale for PRs.
Link to the Docker open source AI contribution policy in our
contribution guidelines.
## Related issues or tickets
https://docker.slack.com/archives/C039ZM6GH4Z/p1793044325677639
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Description
Gordon answers everything in plain markdown, even when the answer is a
procedure or a comparison. Those answers are harder to scan than they
need to be. This PR lets Gordon put a small card inside its answer when
that helps:
- **Steps** for procedures, with commands in code boxes
- **Tables** for comparisons (limits, plans, options)
- **Notes** for warnings, active incidents or tips
- **Code snippets** for config files
- **Follow-up questions** as chips. Selecting one asks it as your next
question.
```
You can containerize it with docker init, then run it with Compose.
┌───────────────────────────────────────────────┐
│ Containerize a Node.js app │
│ ① Generate the Docker assets │
│ [ docker init ] │
│ ② Build and run the app │
│ [ docker compose up --build ] │
│ ▌ Use Docker Hardened Images for security │
│ ( How do I add a database service? ) │
└───────────────────────────────────────────────┘
Sources:
- https://docs.docker.com/guides/nodejs/
```
Short answers, explanations and greetings stay plain markdown.
### How it works
```
chat ── "I can draw cards" (ui: "openui-v1") ──▶ Gordon
chat ◀── markdown answer, with at most one ```openui-lang block ── Gordon
chat: draws the block as a card, everything else as markdown
```
- The chat sends one extra field with each question. Only then does
Gordon's backend tell the model it may add a card. Without the field,
answers are the same as today.
- A card is a fenced block of [OpenUI
Lang](https://www.openui.com/docs/openui-lang) inside the normal answer
text, so the conversation history and stored messages stay plain text.
- The chat draws the block with its own styles. Anything it doesn't
recognize is left out, and if the card code can't load, the block shows
as a plain code block.
### Visual change to all answers
Gordon's answers are no longer inside a grey bubble. A framed card
inside the grey bubble looked like a box in a box. Answers now sit on
the panel background at full width, and the card stands out as its own
block. Your own messages keep the blue bubble.
<!-- screenshots: before / after, light and dark -->
### Rollout
- Cards are **on in local builds and deploy previews**, and **off in
production**.
- To turn them on in production, set `params.gordon.cards: true` in
`hugo.yaml`.
- Gordon's backend already supports this, so no other change is needed.
### Other notes
- **Safety:** card text from the model is only ever inserted as text,
never as HTML.
- **Page weight:** the card code (about 120 KB gzipped) is a separate
bundle. It's only downloaded when an answer first contains a card, never
on page load.
- **Copy button:** copies the answer with cards written out as markdown
(numbered steps, a table, `> [!NOTE]`), not the raw card code. Follow-up
chips are left out.
- **Instructions Gordon gets:** the prompt lives entirely in Gordon's
backend, which injects it when the chat sends `ui: "openui-v1"`. This
repo only has the component list the chat draws
(`assets/js/gordon-cards/components.mjs`). The backend's card prompt
describes the same components, so when adding or changing one, the
backend's prompt changes with it.
- **New dependencies:** `@openuidev/lang-core` (the OpenUI Lang parser)
and `zod`, pinned. Its usage telemetry never runs in a browser, and
`.npmrc` already blocks install scripts.
### How to test
1. Run `docker compose watch` and open http://localhost:1313. Local
builds use Gordon's staging backend.
2. Open Gordon from the header and ask:
- **Should show a card:** "How do I containerize my Node.js app?", "What
are the Docker Hub pull limits?", "How do I set up a registry mirror?"
- **Should stay plain text:** "What is Docker Scout?", "hi"
3. Select a follow-up chip. It should ask that question.
4. Select **Copy** on an answer with a card. The pasted text should be
markdown.
5. Reload the page. Cards should come back from the conversation
history.
6. Check dark mode.
7. In the browser's Network tab, check:
- each question to `/public/ask` includes `"ui": "openui-v1"`;
- `gordon-cards.js` only loads after the first answer with a card.
## Related issues or tickets
<!-- none public -->
## Reviews
- [x] Technical review
- [ ] Editorial review
- [ ] Product review
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Description
The rclone example in the volumes guide installs the plugin with
`--aliases rclone`. `docker plugin install` has no `--aliases` flag, so
the command fails before it reaches the daemon:
```console
$ docker plugin install --grant-all-permissions rclone/docker-volume-rclone --aliases rclone
unknown flag: --aliases
```
The flag is `--alias` ("Local name for plugin"), as listed in the
[`docker plugin install`
reference](https://docs.docker.com/reference/cli/docker/plugin/install/)
and used in the [rclone Docker plugin docs](https://rclone.org/docker/).
The later steps in the guide use `-d rclone` and `volume-driver=rclone`,
so they need the plugin to be installed under that alias.
I checked the flag parsing with Docker CLI 29.1.3 against a non-existent
daemon socket: `--aliases` fails with `unknown flag`, while `--alias
rclone` parses and only fails to connect. `npx --no-install rumdl fmt`
and `scripts/lint.sh` (rumdl 0.2.49, Vale 3.17.0) report no issues on
the changed line.
## Related issues or tickets
None.
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
## Description
Add `COPY --chmod=755` to the wrapper-script copy instruction in both
examples on the [multiple-process container
guide](https://docs.docker.com/engine/containers/multi-service_container/).
A newly created wrapper commonly has mode `0644`; `COPY` preserves that
mode, so `CMD ./my_wrapper_script.sh` exits with 126 before the script
starts.
The issue reproduction was run verbatim. With `umask 022`, the original
Dockerfile returned 126 with `Permission denied`; the `COPY --chmod=755`
control ran successfully, as did the original Dockerfile after making
the host wrapper executable. Both documented recipes were also
reproduced with deterministic stand-ins; the job-control recipe's mode
control was run with a TTY.
Validation: `npx --no-install rumdl fmt` (rumdl 0.2.49) and
`scripts/lint.sh` (rumdl 0.2.49, Vale 3.17.0) passed on the changed
file. No full-site build was run for this two-line documentation change.
## Related issues or tickets
Fixes#26447
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: maheshrijal <62394512+maheshrijal@users.noreply.github.com>
## Summary
- Stop mounting Docker Agent Community on docs.docker.com; keep
technical sections and Guides mounted.
- Sync the module pin and generated vendor files to Docker Agent
v1.152.0, which includes docker/docker-agent#4618 (`cc52bd76`).
- Redirect the Community root, Contributing, and Resources to GitHub
Pages. Preserve the three technical-page redirects through upstream
aliases.
## Merge order
Depends on #26451 for Go 1.27. This branch includes its commit by
ancestry; both PRs target `main`. Merge #26451 first.
Coordinate with the docs team: this supersedes the sync in #25913. Draft
#25919 remains suspended and compatible. Neither bot PR was edited or
closed.
## Redirects
| Former `/ai/docker-agent/` path | Destination |
| --- | --- |
| `community/` |
https://docker.github.io/docker-agent/community/contributing/ |
| `community/contributing/` |
https://docker.github.io/docker-agent/community/contributing/ |
| `community/resources/` |
https://docker.github.io/docker-agent/community/resources/ |
| `community/telemetry/` | `/ai/docker-agent/configuration/telemetry/` |
| `community/opentelemetry/` |
`/ai/docker-agent/configuration/opentelemetry/` |
| `community/troubleshooting/` |
`/ai/docker-agent/guides/troubleshooting/` |
The GitHub Pages `/community/` root returns 404, so the former section
root redirects to Contributing.
## Validation
CI passes, including build, vendor validation, and redirect tests. Local
checks passed for all 9 redirect unit tests, six generated mappings, and
24 CloudFront cases covering trailing slashes and query strings.
Update `GO_VERSION` from 1.26 to 1.27 in the root and releaser
Dockerfiles. Keep the floating minor-version image tags used in
6a093939d4 and da3893027f; both 1.27 tags resolve to Go 1.27.3 on
October 26, 2026. Unlike those broader updates, this PR leaves module
files and the Go version used in documentation examples unchanged.
Docker Agent v1.151.0 and later require Go 1.27. The official Go image
sets `GOTOOLCHAIN=local`, so the Go 1.26 build cannot vendor those
releases. Daily `sync-docker-agent-docs` runs have failed since at least
October 24, 2026; the [October 26
run](https://github.com/docker/docs/actions/runs/40261071727) reports
this version mismatch while vendoring v1.152.0.
#26368 will be stacked on this PR to sync Docker Agent v1.152.0 and fix
the Community links. Merge this toolchain upgrade first.
Validation: `dockerfile-lint`, `releaser-build`, `releaser-test` (9
tests), and `validate-api-reference` passed with `docker buildx bake`.
Local `validate-vendor` and `test` hit the existing Community vendor
mismatch and nine missing references from the separately applied #26368
changes. CI on this isolated two-line PR is the authoritative check for
those targets.
## Description
Adds public documentation for `GET /v2/auditlogs/governance/{org_name}`
and aligns the guide and OpenAPI reference with merged data-platform
main (`66bc70971`), including
[docker/data-platform#2711](https://github.com/docker/data-platform/pull/2711)
and
[docker/data-platform#2712](https://github.com/docker/data-platform/pull/2712).
- Documents raw Organization Access Token authentication and the View
audit logs permission.
- Covers the 25-event default, 100-event page cap, 30-day request
window, and cursor-preserved time bounds. Text search can use the
default window.
- Documents the API and gateway organization limits of 5 requests per
second and the gateway limit of 600 requests per minute per source IP.
Clients and tokens share the organization limits, and each pagination
request counts.
- Updates the structured application 429 example to `limit: 5`,
`window_seconds: 1`, and `retry_after_seconds: 1`.
- Keeps Retry-After optional: application responses include it when the
reset time is known, while gateway responses can omit it and use a
different body. The chart-owned Lua policy was removed in
[docker/data-platform#2725](https://github.com/docker/data-platform/pull/2725);
these docs do not promise gateway header translation.
- Covers request deadlines, search timeouts, and retryable dependency
failures, with links to the audit record reference and
subscription/access-token pages.
## Release status
The production route and gateway policies are enabled in the merged
configuration. One unauthenticated GET to
`https://api.docker.com/v2/auditlogs/governance/vonwig?page_size=1`
returned HTTP 401 with `{"error":"missing or malformed Authorization
header"}`, confirming public routing and missing-token rejection.
Before publishing, confirm the OAT View audit logs permission is
available in Docker Home and record authorized production
query/pagination, organization/IP throttling, retry behavior, and
monitoring validation. No authenticated request or rate-limit load test
was performed in this update. Merged configuration and a 401 response do
not establish those outcomes.
## Validation
- Scoped rumdl and Vale checks: passed with 0 errors, warnings, or
suggestions.
- Prettier check for the OpenAPI YAML: passed.
- OpenAPI 3.0 validation: passed using @apidevtools/swagger-parser
10.1.0.
- Public server and application 429 example checked against the merged
production values.
- `git diff --check`: passed.
- Full Hugo rendering and rendered link validation were not run; PR CI
and the deploy preview still need review.
Documents six user-facing changes in sbx 0.50: kit host mount bindings,
persistent kit volume retention, environment MCP command approvals and
ownership, HTTP query restrictions, cloud sandbox inspection, and exec
exit status in automation. Each change has its own commit. Also vendors
the matching v0.50 CLI reference verbatim and regenerates the release
notes from published GitHub releases.
Kit documentation focuses on sbx usage and links to the canonical
capability definitions. Volume retention follows the 0.50
implementation; the upstream spec's main branch describes a different
storage lifecycle.
Verified against the release implementation. Scoped Markdown and prose
lint, a full Hugo build, and checks of the added internal links pass.
Related release: https://github.com/docker/sandboxes/issues/7698
Generated by Codex
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
The variable reference omits the remote Bake Git advice control.
Show how to enable advice and distinguish definition fetching from the
build argument used for Git build contexts.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The guide duplicates incomplete key lists and uses older plural selectors.
Link to the CLI reference for exhaustive keys, distinguish selectors from
Bake file attributes, and explain aliases and inline list operations.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The overrides guide omits the named secret override supported by Bake.
Show environment and file sources, and explain the declared-ID and
replacement constraints.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The policy guide teaches the hidden filename flag and omits stdin input
and platform selection. Use the supported file flag and add examples for
both capabilities.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Policies can inspect provenance metadata beyond the hasProvenance flag.
Document the available fields and show checks for hermetic builds and
complete dependency records, with a signature verification caveat.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The Bake guides only describe environment-based variable overrides.
Add var flag examples, precedence and type behavior, and its distinction
from target attribute overrides.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
The guide incorrectly states that Bake policy options require CLI flags.
Document policy objects in HCL and show explicit loading with strict mode.
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Manuel de la PeñaandClaude Sonnet 5
David Karlsson
CrazyMax
Greg MondelloandClaude Opus 4.8
Trung Nguyen
Craig Osterhout
Allie Sadler
Jooyoung Lim
Mahesh Rijal
Arnaud Héritier
Brian Refsdal