## Description
Add Docker Skills to the discovery links near the top of generated
`llms.txt`, and point the MCP link to
`https://ai-backend-service.docker.com/mcp` for direct access to the
Docker RAG server.
Changes the Hugo template only; the generated file is not checked in.
## Reviews
Verified the skills page returns HTTP 200 and the MCP endpoint
initializes as `gordon-rag`. Rendered the updated template with Hugo in
a minimal site and confirmed both discovery links appear in the
generated header. `git diff --check` passes. A full docs-site build was
not run.
- [ ] Technical review
- [ ] Editorial review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Documentation updates can be technically accurate yet unnecessary,
duplicated, or poorly placed. Update research to justify an edit through
the reader's task and a specific documentation gap, write to integrate
it into the existing page, and review-changes to assess reader value,
placement, and flow.
Keep the guidance in the existing skills, without a required reporting
template. Each skill update has its own commit.
Markdown checks pass; Vale reports only pre-existing findings outside
the edited lines. Skill validation passes after excluding unchanged
Claude-specific metadata unsupported by the Codex validator.
Generated by Codex
## Summary
Custom secret injection is limited to HTTP request headers, but the
credentials page recommended it for secrets in request bodies and
described replacement anywhere in a request. Remove that use case and
clarify the header-only restriction.
@netlify /ai/sandboxes/configuration/credentials/
Generated by Codex
## Description
Explain how the generated Kits section points agents to each kit's
guidance, including packaged context files under
`/usr/share/sandbox/kit/<stem>/` and the location of inline
instructions.
@netlify /ai/sandboxes/customize/use-kits/
Generated by Codex
Document `sbx mcp unload` for removing a server from a running sandbox
without restarting the agent. Explain how to reload it, distinguish
unloading from removing its registration, and describe what happens
after unloading all static servers.
Validation: Markdown and style checks pass.
Generated by Codex.
## Description
Built-in agent names select v2 kits, while published v3 workloads such
as `sbx/claude` collide with those names. This change recommends v3,
maps built-in agents to published v3 workloads with distinct names, and
shows compatible CLI, kit set, and environment-file examples. The
environment-file guide starts with a built-in v2 agent and links to a
separate v3 workflow.
Compatibility, capability requirements, and migration steps each live on
the page where readers need them.
Scoped Markdown and Vale checks pass. OCI manifests verify the v2
Playwright mixin and the published v3 references; v0.48.0
agent-registration and environment kit-resolution tests pass. A full
sandbox launch was unavailable because Docker sign-in is required in
this workspace.
@netlify /ai/sandboxes/customize/use-kits/
Generated by Codex
The Console getting started page ended at sandbox launch. Expand it into
a complete first session: review a public sample project with Claude
Code, inspect and save the result, optionally connect VS Code or Cursor
over SSH, and pause or delete the sandbox.
Preserves the sandbox options reference and existing heading anchors.
The platform overview remains the gateway to concepts; use-case guides
remain separate in #26321.
Formatting, scoped Markdown and Vale lint, Hugo build, and all 19
internal links passed. This remains a draft pending live Console, cloud
SSH, and editor verification.
@netlify /agentic-platform/get-started/
[Preview the
walkthrough](https://deploy-preview-26339--docsdocker.netlify.app/agentic-platform/get-started/)
Generated by Codex
## Summary
Update the Sandbox documentation for the v0.48.0 CLI refactor: renamed
flags, settings commands, terminal output, structured output, and
non-interactive confirmations. Add a migration reference for scripts and
CI workflows, with a [**Copy as prompt**
button](https://deploy-preview-26314--docsdocker.netlify.app/ai/sandboxes/workflows/automation/#update-scripts-for-v0480)
that copies agent instructions and the section Markdown.
This PR targets `main` independently of the other PRs in the sbx/v0.48.0
milestone. It keeps the generated reference import separate from
documentation edits:
- Vendor the 120 generated CLI YAML files
- Update command examples and guidance. Historical release notes retain
their original command spellings.
The other milestone PRs cover separate release features; this PR covers
the CLI migration.
@netlify /ai/sandboxes/workflows/automation/
Generated by Codex
Several sandbox feature guides omit supported tasks or describe them
inaccurately. This change fills those gaps in the documentation for
released Sandboxes v0.47.0 and organizes the additions around the tasks
readers need to complete.
- MCP: document DHI registration after the other server inputs, make
OAuth client changes a focused maintenance task, and place resource
overrides after normal OAuth setup.
- Environment files: consolidate file placement and write protection
after the first setup example, and explain plan output before listing
its symbols.
- Cloud: separate saving and reusing templates, importing local
templates, and customizing with kits. Explain capture modes beside the
relevant operations.
- Skills: correct import precedence, include OpenCode, and explain
skipped linked dependencies after the import command.
- Kits v2: correct the downloaded archive formats in the command entry
and put provenance inspection with signing and verification. Omit OCI
storage details that don't help complete these tasks.
Behavior was checked against the v0.47.0 source. In particular,
replacing an OAuth client secret does not clear its previous identity
binding; the recovery task retains the required reset and tells readers
to verify the intended client and provider first.
Validation: scoped Markdown and Vale lint passed, the full Hugo
development build passed, and checks of the five rendered guides
confirmed complete code blocks, visible placeholders, plan indentation,
valid same-page anchors, skills import order, and the revised task
headings. Changes are committed separately by issue. The v0.48 migration
remains in #26314.
```release-note
NONE
```
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
## Summary
The v2 kit reference says that adding a kit with startup commands
requires removing and recreating the sandbox. Document support for
startup commands through `sbx kit add` and explain when they run.
Implementation:
[docker/sandboxes#6886](https://github.com/docker/sandboxes/pull/6886).
Checked against the `release/v0.48` source and its regression coverage.
Changed Markdown passes rumdl and Vale.
For [Sandboxes
v0.48.0](https://github.com/docker/sandboxes/issues/7014); kept in draft
for the upcoming release.
@netlify /ai/sandboxes/customize/kits-v2/
Generated by Codex
Add a kit capability support reference showing local and cloud
availability, minimum `sbx` versions, capability-group behavior, and
restrictions on `sbx kit add`. Link it from the authoring overview and
clarify that v3 kits must request SSH-agent forwarding. Keep capability
definitions and examples in the upstream specification.
Validation: Markdown and style checks pass; upstream capability links
verified.
Generated by Codex.
Document the Windows SSH-agent fallback under `ssh.agentSocketPath`,
including what happens when both the setting and `SSH_AUTH_SOCK` are
unset. Keep the general SSH-agent guide focused on setup and linked to
the settings reference.
Validation: Markdown and style checks pass.
Generated by Codex.
Document how to select a model reasoning level with `sbx run --variant`,
with an example and the relevant agent limitations.
Validation: Markdown and style checks pass.
Generated by Codex.
Document desktop app connections that create a sandbox on first use and
reuse it on later connections. Keep the shared setup and lifecycle
behavior on the integrations overview, with brief links from the ChatGPT
and Claude Desktop pages.
Validation: Markdown and style checks pass.
Generated by Codex.
Document using stored API keys for hosted and custom model providers.
Explain how the host proxy supplies the key to the model service and
make clear that selecting a provider does not restrict the key to that
provider's endpoint. Clarify the environment-variable fallback.
Validation: Markdown and style checks pass.
Generated by Codex.
Document expiration settings for cloud moves and environments, including
automatic restart at expiration. Organize the cloud environment guidance
into task sections covering setup, supported settings, expiration,
credentials, reuse, removal, and recovery.
Validation: Markdown and style checks pass.
Generated by Codex.
## Summary
Kit authors can use `SBX_AGENT` to choose setup behavior for the
provisioned agent. Document the value for built-in and custom agents,
and how install hooks request the variable.
Implementation:
[docker/sandboxes#6876](https://github.com/docker/sandboxes/pull/6876).
Checked against the `release/v0.48` source and its regression coverage.
Changed Markdown passes rumdl and Vale.
For [Sandboxes
v0.48.0](https://github.com/docker/sandboxes/issues/7014); kept in draft
for the upcoming release.
@netlify
/ai/sandboxes/customize/author/#pass-environment-variables-to-hooks
Generated by Codex
## Summary
The build policy docs covered HTTP downloads through `ADD` but did not
explain how to block URLs requested by `RUN` steps. Add a tested
allowlist example using `"caps": {"exec.proxy": true}` in the policy
file and update the HTTP input reference, with a brief builder flag
example for CI.
Verified that Debian package downloads pass and the blocked URL returns
HTTP 403 and fails the build. Scoped Markdown and Vale checks passed,
with one existing Vale warning on unchanged text.
@netlify /build/policies/usage/
Generated by Codex
## Summary
Removes files left over from earlier agent tooling that nothing
references anymore, and moves the `curate-whats-new` examples next to
the skill that uses them.
- Delete `tech_writer.yml` and `docs_engineer.yml`, unused docker-agent
configs, and the `.validation.log` ignore entry that only they wrote.
- Delete `.github/prompts/`, unreferenced Copilot prompt files that link
to a nonexistent style guide.
- Move `.github/agents/whats-new-examples/` to
`.agents/skills/curate-whats-new/examples/`.
`.github/agents/docs-scanner.yaml` and the `docker-agent-action`
workflows stay, since CI still uses them.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
## Summary
Remove experimental badges and notices for the Cloud Sandboxes CLI, API,
and SDK, including the API reference card and CLI release notes.
Preserve the Docker Agentic Platform experimental status, the
subscription requirement, and feature-specific experimental warnings.
@netlify /ai/sandboxes/cloud/
Generated by Codex
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
## Summary
Gordon's Supplemental Terms are no longer in effect. Replace the
reference under Questions about privacy with a link to the Docker
Subscription Service Agreement.
@netlify /ai/gordon/concepts/data-privacy/
Generated by Codex
Monitoring guides were grouped under CI/CD, and several other guides had
categories that did not match their main purpose. Add Observability,
rename Deployment to Services & infrastructure, and move LocalStack and
Django into Testing and Languages & frameworks.
Remove the E2B workflow and integration documentation and both Ollama
application guides. Remove E2B navigation and promotional links.
Redirect former E2B URLs to Docker Sandboxes and former Ollama guide URLs
to Docker Model Runner.
The Build Cloud, Compose, Scout, Testcontainers Cloud, and
container-supported development guides mostly repeat product benefits
and introduce videos instead of teaching distinct tasks.
Remove these five guides and their unused images, update incoming links,
and redirect all former page and chapter URLs to the relevant product
docs or hands-on lab. Keep both administration guides.
The Testcontainers collection includes nine specialized Java integration
tutorials with modest readership and overlapping framework setup.
Remove these guides and their links from the Testcontainers overview,
retaining eleven guides covering language introductions, general
techniques, representative web frameworks, and Testcontainers Cloud.
The NLP examples, TensorFlow.js face detection guide, Neo4j RAG guide,
and video chatbot guide have low readership and repeat application
setup or containerization covered by other guides.
Remove these eight guides and the nine images used only by them.
No remaining content or config entries reference the removed guides.
## Description
Documents the user-facing changes in Docker Sandboxes v0.47.0 and
updates the CLI reference.
- `sbx run --rm` removes the sandbox when the agent exits, for local and
cloud sandboxes.
- `sbx run --detached` keeps a local sandbox running after its sessions
end.
- Kits can declare the `long-running@1` capability to keep their sandbox
running.
- `sbx move` to the cloud applies the kit's network rules.
- MCP authorization requests `offline_access` with default scopes, so
servers can issue refresh tokens.
- UDP to local-network destinations is blocked regardless of network
policy.
- `sbx --cloud ttl` reports stopped sandboxes as stopped instead of
expired.
- The CLI reference is updated for v0.47.0.
@netlify /ai/sandboxes/usage/
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
sbx --cloud ttl no longer reports a stopped sandbox as expired. Explain
that resuming starts a new time-to-live period and describe the
stopped and ttl_paused JSON fields.
Source: docker/sandboxes#6388
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
UDP to multicast, link-local, unspecified, and broadcast destinations
is dropped before policy evaluation, so no allow rule can permit it.
Explain the effect on discovery protocols and how the network log
reports these connections.
Source: docker/sandboxes#5875
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
When sbx uses recorded default or resource-required scopes, it also
requests offline_access if the authorization server advertises it, so
the server can issue a refresh token. Explicit --scope values are
requested as given.
Source: docker/sandboxes#6284
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
sbx move --to cloud now applies the sandbox's kit or agent network
rules, as sbx --cloud create does. Rules added locally still don't
transfer. Correct the move and cloud network policy pages, which said
no local rules apply.
Source: docker/sandboxes#6707 (backported as #6814)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain how a kit declares long-running@1 to keep its sandbox running
after sessions end, how required and optional entries behave, and that
cloud sandboxes and sbx kit add can't provide it.
Source: docker/sandboxes#6710
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain that sbx run --detached keeps a local sandbox running after its
sessions end, and that running it against an existing sandbox switches
that sandbox to detached mode permanently.
Source: docker/sandboxes#6600
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Explain that --rm removes a local or cloud sandbox when the agent
session exits, when a reattached sandbox is kept, and why --rm can't be
combined with --detached or --detach-keys.
Source: docker/sandboxes#6601
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
See commit message(s).
Just fixes a small hiccup on the docs! It makes it sounds like Debian
comes with ufw but it doesn't.
> nftables is the default and recommended firewalling framework in
Debian…
>
> It is recommended to run
[?](https://wiki.debian.org/firewalld)firewalld…
>
> \- [Debian Wiki: nftables](https://wiki.debian.org/nftables)
Just to confirm, I also installed Debian on a VM and checked if ufw was
present, and indeed it wasn't. This was run on a fresh express Debian
install:
```txt
root@debian13-uni:/home/seth# ufw
bash: ufw: command not found
root@debian13-uni:/home/seth#
```
- [ ] Technical review
- [x] Editorial review
- [ ] Product review
## Summary
The kit docs explain published sets and direct mixin composition but
don't help readers choose between a set and an environment file. Clarify
when to use each, link to environment files from the mixin composition
instructions, and note that separately composed OCI kits need distinct
image repository names.
@netlify /ai/sandboxes/customize/
Generated by Codex
## Summary
Add the Docker Skills launch omitted from the September curation in
#26195 and update the featured ranking.
## Selected entries
- Docker Skills — Give coding agents guidance with Docker Skills
(#26169)
## Curation notes
Retained all seven existing entries and expired none. The retained Run
agents without mounting host files entry remains in the timeline but is
no longer featured, keeping the five featured slots for the
highest-ranked launches.
Generated by Codex
## Summary
Extend the Docker Docs launch timeline through September 27 and feature
three Docker Sandboxes launches.
## Selected entries
- Docker Sandboxes — Run sandboxes on Docker-managed cloud
infrastructure (#26142, #26157, #26158, #26181)
- Docker Sandboxes — Manage cloud sandboxes with the API and TypeScript
SDK (#26142, #26168)
- Docker Sandboxes — Compose sandbox environments with kits v3 (#26065,
#26157)
## Curation notes
Retained four entries and removed six entries published before the new
August 29 window. No retained entry content or sources changed.
Docker Desktop 4.92, DHI webhook metadata, API reference migrations, and
the Desktop Kubernetes command references did not meet the threshold for
a Docker-wide launch highlight.
Generated by Codex
## Summary
Refresh the vendored Sandboxes cookbook and OpenAPI reference from
upstream.
Removes standalone MCP gateway start/stop documentation, imports
upstream authentication and timeout examples, auto-resume readback
guidance, and network-policy selector updates, and regenerates the API
presentation data.
@netlify /ai/sandboxes-api/cookbook/give-a-sandbox-an-mcp-gateway/
Generated by Codex
Sync the Sandboxes release notes with `hack/sbx-release-notes.py`,
adding v0.45.1 fixes and the v0.45.0 cloud-support highlight.
Scoped Markdown and Vale checks passed.
@netlify /ai/sandboxes/release-notes/
Generated by Codex
API generation introduced in #26048 added roughly five minutes to site
builds: median successful main-branch build-workflow duration rose from
4m 05s to 8m 48s across September 3–25. The pre-build command took 4m
41s–4m 53s in each of four jobs on the merge commit.
Vendor the generated presentation model in `data/api-reference.json`,
mark it as generated, and let Docker, Netlify, and local Hugo builds
consume it directly. Keep the existing rendered-output checks.
Move generator tests, strict spec validation, and a byte-for-byte
regeneration check into `docker buildx bake validate-api-reference`,
inheriting the shared Docker base stage. The target uses the pinned
Vacuum release binary with Dockerfile ADD checksum verification and
archive extraction instead of compiling Vacuum from source. The existing
build workflow runs this target alongside the other validation matrix
entries. Only this matrix entry is advisory; its failures do not block
site builds or deployment.
Validated locally with the Docker target, rejection of deliberately
stale data, repeatable generation across directories, a production Hugo
build and verification of 453 API HTML/Markdown page pairs, workflow
syntax checks, and scoped documentation lint. The prebuilt-binary CI
check passed in 1m 40s, down from 5m 15s with source compilation. Remote
layer-cache settings were subsequently removed; local Go cache mounts
remain.
Generated by Codex
Baby step towards cleaning up the sidenav for the ai/agents section.
<img width="306" height="304" alt="image"
src="https://github.com/user-attachments/assets/57ebd1df-9c7f-4ee8-a84f-a61ffec2cd90"
/>
Moves “Use AI models in Compose” into Compose → How-tos and MCP Catalog
and Toolkit into Docker Desktop → Features and capabilities, removing
both entries from the top-level AI and agents sidebar group.
Updates internal source links and preserves existing public URLs. Scoped
lint and a Hugo build passed; rendered sidebar ancestry, MCP page URLs,
and images were checked locally.
Generated by Codex
The Sandboxes API workflow links to the v2 kit reference, whose general
recommendation to use v3 can confuse API readers. Explain that the
documented API artifacts use v2, and scope the v3 development
recommendation to the `sbx` CLI.
Follow-up to #26178. Markdown lint and Vale pass for both changed pages.
@netlify /ai/sandboxes-api/concepts/
Generated by Codex
Fix the main CI REF_NOT_FOUND failure by pointing the Sandboxes API
concepts link to the renamed kits-v2.md page. The target matches the v2
artifact format described by the API.
Hugo build, Markdown lint, and Vale pass.
@netlify /ai/sandboxes-api/concepts/
Generated by Codex
## Description
Add cloud Sandboxes documentation for sbx v0.45.0, covering credentials,
network policy, lifecycle, environment files, and transfers between
local and cloud sandboxes. Document named sandbox reuse and resume,
resource sizes and platform selection, custom secrets, move behavior,
and local UDP guidance.
Link to the canonical Docker Agentic Platform signup, billing, and
Console MCP instructions. Keep CLI sign-in, access checks, and cloud
credential setup in the Sandboxes guides.
This PR also vendors the CLI reference including `sbx move`, and aligns
timeout and move guidance with it. Kits v3 and API/SDK documentation are
handled separately.
Validation: scoped Markdown and Vale checks and a full Hugo build
passed. Cloud and Agentic Platform guides passed rendered internal link
and anchor checks, including the canonical signup page's discovery. The
earlier CLI import verified all 119 vendored files against upstream
byte-for-byte and checked 1,083 rendered CLI-reference links and
anchors. Behavior was checked against source; live cloud workflows and
checkout were not exercised.
@netlify /ai/sandboxes/cloud/
Generated by Codex
## Description
Add an experimental Sandboxes API and SDK section alongside Docker
Sandboxes under AI and agents, at `/ai/sandboxes-api/`. Cover
installation of `@docker/sandboxes`, browser and PAT authentication, and
a TypeScript walkthrough that launches the shell kit, runs a command,
and deletes the sandbox. Explain kits and image choices with examples,
along with compute sizes, quotas, permissions, resource lifecycle,
errors, and retries. Link subscription setup and billing to the shared
Docker Agentic Platform guide. Preserve the previous
`/ai/sandboxes/api/` URLs with redirects.
Uses the shared Docker Agentic Platform documentation merged in #26142.
Sibling to #26158, which introduces CLI-side Cloud Sandboxes
documentation.
Include 36 SDK cookbook recipes at `/ai/sandboxes-api/cookbook/` and the
public REST API reference at `/reference/api/sandboxes/`. Import the
generated export from `docker/sbx-api` commit `60d79c1d` (source
`1a7f4026`). Overview and installation remain maintained here. The
reference uses the shared API renderer from main, with separate
operation and schema pages, streaming and WebSocket details, and a
downloadable OpenAPI spec. An API reference link appears in the API/SDK
sidebar. A pinned manifest and import script provide the basis for later
release automation.
Examples are optional in the shared renderer; supplied examples still
have to pass schema validation. Requests without body examples use a
request-body file with instructions to prepare it. The import copies all
selected recipes and the OpenAPI specification byte for byte from the
corrected upstream export, without patches or link rewrites. The broken
naming recipe remains temporarily excluded.
This remains a draft pending validation against the published npm SDK.
The imported cookbook contains the TypeScript-only guidance, five-minute
request deadlines, kit-readiness explanation, active-policy status
requirement, and snapshot-deletion and lifetime-renewal restrictions.
Validation: scoped Markdown and Vale checks, full Hugo build, rendered
navigation, redirects, and internal links, and TypeScript type-checking
against the generated public SDK from `docker/sbx-api` commit
`68f214b9`. Import validation also covers all 60 REST operations and 188
schema definitions, 1,198 imported-page links and anchors,
desktop/mobile rendering, Markdown output, spec delivery, and a repeat
import. The shared renderer tests, strict generation for all five APIs
(zero diagnostics), full Hugo build, and verification of 453
HTML/Markdown page pairs and API links pass. No live sandbox execution.
The corrected export passes strict generation for all five APIs with
zero diagnostics, scoped Markdown/Vale lint, a full Hugo build, and
verification of 453 HTML/Markdown page pairs and API links. A repeat
import produces identical files. The spec update changes examples only;
schemas and operations are unchanged.
@netlify /ai/sandboxes-api/
Generated by Codex
---------
Co-authored-by: Claude <noreply@anthropic.com>
Add v3 kit documentation for Docker Sandboxes: concepts, usage,
authoring, and kit sets. Link to the upstream specification for
reference details and retain v2 guidance.
Validation: Markdown/style checks, Hugo build, internal links, and
example build checks passed.
Closesdocker/sbx-releases#569
@netlify /ai/sandboxes/customize/
Publish the Docker Agentic Platform documentation as experimental and
add one subscription setup flow for Console, cloud CLI, and API/SDK
users. The section and its billing-plan page become discoverable, with
an Experimental sidebar badge, overview and signup notices, and a
Manuals landing-page entry.
Add `/agentic-platform/signup/` for account prerequisites, checkout,
account-access troubleshooting, and billing. Companion PRs #26158 and
#26168 can replace duplicated activation instructions with
`/manuals/agentic-platform/signup.md#activate-cloud-access` and link
billing guidance to `#billing`. CLI sign-in, credential setup, and API
authentication stay in those guides.
Refresh Console guidance for curated and public kits, custom secrets,
Antigravity, optional credentials, provisioning, sandbox platforms and
lifecycle actions, shell tabs, port access, external MCP clients, and
always-applied policies. Document the 64 MiB declared registry-content
limit and 256 MiB kit-file limit. Scope private-kit restrictions to
Console launches and qualify rollout-dependent controls. CLI tutorials
and kit schema documentation remain in separate work.
Validation: scoped rumdl and Vale checks passed for all 12 changed
Markdown files with no findings. A production Hugo build passed with Git
metadata disabled for the worktree. Rendered checks verified discovery
in sitemap, metadata and llms-full, search indexing eligibility,
experimental marking, signup anchors, and internal link anchors. Live
checkout was not exercised.
The branch is squashed into one commit for stacking.
@netlify /agentic-platform/signup/
Generated by Codex
Settings usage is scattered across individual guides. Add a Settings
page under Configuration explaining value precedence, environment
variables, and when changes take effect. Each catalog entry includes a
use case, an example, and the consequences of changing the setting, with
links to detailed task guides.
A small `setting-metadata` shortcode separates type, default, and
environment variable from prose using a responsive definition list. It
also provides plain Markdown output. Link existing settings mentions to
the reference and remove duplicated explanations while retaining
task-specific instructions.
Verified against Sandboxes v0.45.0 source. Feature-flag controls are
excluded; experimental entries are limited to documented flows. Scoped
lint, the Hugo build, and 70 rendered internal links passed. Checked all
26 metadata records in HTML and Markdown and browser layouts at widths
from 320 to 1440 pixels.
@netlify /ai/sandboxes/configuration/settings/
Generated by Codex
The MCP guide incorrectly describes private OAuth metadata discovery as
blocked. Document its warning behavior and link to an HTTP/2
stream-stall workaround in troubleshooting.
@netlify /ai/sandboxes/mcp-gateway/
Generated by Codex
---------
Co-authored-by: Codex <noreply@openai.com>
The credential guides tell users to recreate sandboxes after changing a
global service secret. Document live service-secret updates and scope
precedence on the credentials page, and link to it from the tool
authentication guide. Include sandbox-scoped removal and fallback to a
global secret.
Complements #26065, which updates kit credential declarations and
bindings in separate sections of these pages.
@netlify /ai/sandboxes/configuration/credentials/
Generated by Codex
---------
Co-authored-by: Codex <noreply@openai.com>
The CI cleanup example needs `--force`, and the persistent environment
example uses unsupported detached execution. Correct both examples and
clarify removal confirmations, foreground execution, and exit handling
for repeatable cleanup.
Verified against `docker/sandboxes` release commit `2f44e051`; scoped
rumdl and Vale checks pass with no findings.
Related to https://github.com/docker/sandboxes/issues/6277.
@netlify /ai/sandboxes/workflows/automation/
Generated by Codex
---------
Co-authored-by: Codex <noreply@openai.com>
Document `sbx run --model` for local models, hosted providers, and
custom inference endpoints in one shared Models page. Move the existing
Claude-only setup there and link from the Claude Code, Codex, and
OpenCode pages. Cover `model.providers`, host API-key authentication,
changing models, and overflow routing.
Scoped rumdl/Vale checks and the full Hugo build pass. Verified rendered
links and anchors, and confirmed a clean merge with #26065. Behavior was
checked against the [release
source](https://github.com/docker/sandboxes/tree/2f44e0511c4fa02d9a137d2702f90ce8284c7c14)
and bundled llmman documentation; live model requests and Windows
execution weren't tested.
@netlify /ai/sandboxes/configuration/models/
Generated by Codex
Explain how to use GitHub Copilot models in OpenCode with the stored
GitHub credential, without a separate device login. Link to the existing
credential setup rather than repeat it.
Verified against the OpenCode kit startup hook and its credential tests
in the release source. Scoped rumdl and Vale checks pass; the two PRs
merge cleanly. Live Copilot authentication wasn't tested.
@netlify /ai/sandboxes/agents/opencode/
Generated by Codex
## Summary
Vendor the OpenAPI 3.2 specification merged in
docker/governor-services#755 and move AI Governance onto the unified API
reference renderer while preserving its existing URLs. This supersedes
#26067, which vendors an earlier upstream revision and retains the
legacy renderer.
@netlify /reference/api/ai-governance/latest/
[Deploy
preview](https://deploy-preview-26125--docsdocker.netlify.app/reference/api/ai-governance/latest/)
Generated by Codex
## Summary
Agents can produce prose that passes style checks but still sounds
unnatural or takes effort to understand. Add guidance to AGENTS.md and a
required prose review with concrete examples to the write skill.
Broaden the skill to cover PR text, release notes, and other prose,
while keeping its branch and commit workflow specific to documentation
fixes.
Markdown formatting passes. Vale reports only existing findings in
unchanged text; the skill validator rejects the existing `hooks` field.
Generated by Codex
The vendored Sandboxes 0.42.0 release notes omitted CVE-2026-77179 and CVE-2026-79994. Re-vendor the updated upstream release notes to include both fixes in a dedicated Security section.
@netlify /reference/api/
[Preview the API
reference](https://deploy-preview-26048--docsdocker.netlify.app/reference/api/)
Adds a shared API reference experience for Hub, DVP, and Registry: a
catalog, operation navigation, linked schemas, request and response
examples, and matching HTML and Markdown output. A validation and
generation pipeline prepares the reference data for Hugo and runs as
part of Docker and Netlify builds.
Migrates the three specifications to OpenAPI 3.2, correcting response
shapes, nullable fields, and authentication and token examples. The Hub
migration also corrects SCIM contracts and CSV exports; DVP gains
complete report response schemas and examples. Registry keeps its
documented Hub-specific subset, with authentication and media
negotiation expressed through OpenAPI security and content fields.
Validation is strict for both checks and generation, with no exception
baseline or bypass flag. The build uses the migrated sources directly,
without migration scripts or records.
Page and specification URLs remain stable, including the DVP alias.
Operation and schema anchors change. Engine and Governance retain their
existing references.
Validated locally with Go tests, strict validation of all three
specifications (zero diagnostics), scoped formatting and lint, and a
full Hugo build checking all 176 HTML/Markdown page pairs, example
parity, reference links, and byte-identical published specifications. A
browser check confirmed raw CSV rendering and the generated request
header. No live API requests were made.
The template cache description omitted the default registry refresh, and users had no guidance for updating installed agents. Correct the cache behavior and explain generic agent updates and their persistence boundary.
Custom images without socat cannot create the forwarded SSH agent socket even when SSH_AUTH_SOCK is set. Document the dependency and link to forwarding settings for other failures.
Nested build containers do not inherit the sandbox certificate store. Add a Dockerfile example that installs the proxy CA, passes build proxy settings, and accounts for an additional organization CA.
The Sandboxes environment-file and kit references narrate routine validation checks that add little value for readers.
Remove redundant validation prose and express kit schema migration as a reader action while retaining configuration constraints and defaults.
The Locked Down description implied that only user-added rules could grant access, overlooking built-in agent kit allowances. Explain preset initialization, show kit-rule inspection, and demonstrate an explicit deny.
The sandbox docs did not describe image attachments for Claude Code. Add a release-note entry and a short explanation of pasting or dropping an image into the terminal before sending a prompt.
David Karlsson
