## Summary
Agents can produce prose that passes style checks but still sounds
unnatural or takes effort to understand. Add guidance to AGENTS.md and a
required prose review with concrete examples to the write skill.
Broaden the skill to cover PR text, release notes, and other prose,
while keeping its branch and commit workflow specific to documentation
fixes.
Markdown formatting passes. Vale reports only existing findings in
unchanged text; the skill validator rejects the existing `hooks` field.
Generated by Codex
The vendored Sandboxes 0.42.0 release notes omitted CVE-2026-77179 and CVE-2026-79994. Re-vendor the updated upstream release notes to include both fixes in a dedicated Security section.
@netlify /reference/api/
[Preview the API
reference](https://deploy-preview-26048--docsdocker.netlify.app/reference/api/)
Adds a shared API reference experience for Hub, DVP, and Registry: a
catalog, operation navigation, linked schemas, request and response
examples, and matching HTML and Markdown output. A validation and
generation pipeline prepares the reference data for Hugo and runs as
part of Docker and Netlify builds.
Migrates the three specifications to OpenAPI 3.2, correcting response
shapes, nullable fields, and authentication and token examples. The Hub
migration also corrects SCIM contracts and CSV exports; DVP gains
complete report response schemas and examples. Registry keeps its
documented Hub-specific subset, with authentication and media
negotiation expressed through OpenAPI security and content fields.
Validation is strict for both checks and generation, with no exception
baseline or bypass flag. The build uses the migrated sources directly,
without migration scripts or records.
Page and specification URLs remain stable, including the DVP alias.
Operation and schema anchors change. Engine and Governance retain their
existing references.
Validated locally with Go tests, strict validation of all three
specifications (zero diagnostics), scoped formatting and lint, and a
full Hugo build checking all 176 HTML/Markdown page pairs, example
parity, reference links, and byte-identical published specifications. A
browser check confirmed raw CSV rendering and the generated request
header. No live API requests were made.
The template cache description omitted the default registry refresh, and users had no guidance for updating installed agents. Correct the cache behavior and explain generic agent updates and their persistence boundary.
Custom images without socat cannot create the forwarded SSH agent socket even when SSH_AUTH_SOCK is set. Document the dependency and link to forwarding settings for other failures.
Nested build containers do not inherit the sandbox certificate store. Add a Dockerfile example that installs the proxy CA, passes build proxy settings, and accounts for an additional organization CA.
The Sandboxes environment-file and kit references narrate routine validation checks that add little value for readers.
Remove redundant validation prose and express kit schema migration as a reader action while retaining configuration constraints and defaults.
The Locked Down description implied that only user-added rules could grant access, overlooking built-in agent kit allowances. Explain preset initialization, show kit-rule inspection, and demonstrate an explicit deny.
The sandbox docs did not describe image attachments for Claude Code. Add a release-note entry and a short explanation of pasting or dropping an image into the terminal before sending a prompt.
The Sandboxes guides omitted custom MCP request headers, didn't explain
the MCP secrets shown by `sbx secret ls`, and described older OAuth
discovery and scope-selection behavior.
Document API-key setup, host-only MCP credentials, managed endpoint
records, rotation, restart requirements, and removal. Correct OAuth
client-secret naming and explain migration from the older spelling.
Cover the advertised common OIDC scope fallback, non-blocking scope
warnings, and `--skip-ssrf-check` for private OAuth metadata discovery
and redirects, as backported in docker/sandboxes#6079.
Markdown and Vale checks pass for the changed pages.
@netlify /ai/sandboxes/mcp-gateway/
Generated by Codex
The registry credentials guide omits `--registry-auth-endpoint`. Add a
self-hosted GitLab example and explain the exact HTTPS host and path
trusted to receive the registry credential, URL restrictions, and
behavior without explicit configuration.
Validation: scoped rumdl and Vale checks pass with no issues.
@netlify /ai/sandboxes/configuration/credentials/
Generated by Codex
Document `sandboxOptions.skills` in `sbxenv.yaml`, including the `off`,
`readonly`, and `readwrite` modes and the daemon-resolved default for
sbx v0.43.0.
@netlify /ai/sandboxes/configuration/environment-files/
Generated by Codex
The usage guide shows only the legacy prune filter and does not explain why a sandbox created without attaching can stop before its first use.
Use the v0.43 until filter, describe its accepted values, and explain automatic stopping and reattachment after sbx create.
The v0.42 shorthand limitation interrupts the quick start for Kiro, Copilot, and Droid even though v0.43.0 restores launching them by name. Remove the three callouts and preserve the affected-version guidance and full kit workarounds in troubleshooting.
This updates documentation for csv exports between organizations and
companies. For organizations, csv exports are async : you download and a
csv file is sent to your email. Company still downloads to your browser.
PR also does freshness pass across both docs, aligning verbiage on how
we refer to users (that is, not referring to them as users and
defaulting to Docker Home language of invitees or members)
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Add a 2026-09-14 entry for the BuildKit v0.33.0 rollout to cloud builders:
the attestation export limit raised from 40 MiB to 80 MiB, the Dockerfile
frontend update to v1.27.0, broader inline-credential redaction, Git advice
suppression, three customer-visible bug fixes, and Buildx v0.37.0
verification.
Add a 2026-08-18 entry for the BuildKit v0.32.2 rollout, which reached
cloud builders without a release note. It reverted the v0.32.1 attestation
push-order workaround, and the entry documents the exporter attribute to
use with registries that reject a referrer pushed before its subject.
David Karlsson
Craig Gumbley
Craig Osterhout
Paweł Gronowski
temenuzhka-thede
Sebastiaan van Stijn
Dan Luhring
Allie Sadler
CrazyMax
docker-tools-robot