The Sandboxes environment-file and kit references narrate routine validation checks that add little value for readers.
Remove redundant validation prose and express kit schema migration as a reader action while retaining configuration constraints and defaults.
The sandbox docs did not describe image attachments for Claude Code. Add a release-note entry and a short explanation of pasting or dropping an image into the terminal before sending a prompt.
The Sandboxes guides omitted custom MCP request headers, didn't explain
the MCP secrets shown by `sbx secret ls`, and described older OAuth
discovery and scope-selection behavior.
Document API-key setup, host-only MCP credentials, managed endpoint
records, rotation, restart requirements, and removal. Correct OAuth
client-secret naming and explain migration from the older spelling.
Cover the advertised common OIDC scope fallback, non-blocking scope
warnings, and `--skip-ssrf-check` for private OAuth metadata discovery
and redirects, as backported in docker/sandboxes#6079.
Markdown and Vale checks pass for the changed pages.
@netlify /ai/sandboxes/mcp-gateway/
Generated by Codex
The registry credentials guide omits `--registry-auth-endpoint`. Add a
self-hosted GitLab example and explain the exact HTTPS host and path
trusted to receive the registry credential, URL restrictions, and
behavior without explicit configuration.
Validation: scoped rumdl and Vale checks pass with no issues.
@netlify /ai/sandboxes/configuration/credentials/
Generated by Codex
Document `sandboxOptions.skills` in `sbxenv.yaml`, including the `off`,
`readonly`, and `readwrite` modes and the daemon-resolved default for
sbx v0.43.0.
@netlify /ai/sandboxes/configuration/environment-files/
Generated by Codex
The usage guide shows only the legacy prune filter and does not explain why a sandbox created without attaching can stop before its first use.
Use the v0.43 until filter, describe its accepted values, and explain automatic stopping and reattachment after sbx create.
The v0.42 shorthand limitation interrupts the quick start for Kiro, Copilot, and Droid even though v0.43.0 restores launching them by name. Remove the three callouts and preserve the affected-version guidance and full kit workarounds in troubleshooting.
This updates documentation for csv exports between organizations and
companies. For organizations, csv exports are async : you download and a
csv file is sent to your email. Company still downloads to your browser.
PR also does freshness pass across both docs, aligning verbiage on how
we refer to users (that is, not referring to them as users and
defaulting to Docker Home language of invitees or members)
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Add a 2026-09-14 entry for the BuildKit v0.33.0 rollout to cloud builders:
the attestation export limit raised from 40 MiB to 80 MiB, the Dockerfile
frontend update to v1.27.0, broader inline-credential redaction, Git advice
suppression, three customer-visible bug fixes, and Buildx v0.37.0
verification.
Add a 2026-08-18 entry for the BuildKit v0.32.2 rollout, which reached
cloud builders without a release note. It reverted the v0.32.1 attestation
push-order workaround, and the entry documents the exporter attribute to
use with registries that reject a referrer pushed before its subject.
<!--Delete sections as needed -->
## Description
Clarified that a network rule resource without a port matches every port
on that destination.
## Related issues or tickets
ENGDOCS-3370
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
The Agentic Platform lifecycle guidance did not explicitly cover background processes. Clarify that all processes inside a sandbox stop when the sandbox stops.
Fetch the Docker style package from docs-toolkit and retain only the local vocabulary and repository-specific configuration. Resolve existing canonical-name violations exposed by the shared package.
## Description
Document GitHub Actions cache write restrictions that can cause cache
export to fail after a successful image push, including workflows
triggered when a pull request is merged into the default branch. Explain
how to restore cache in read-only workflows and populate it from a
workflow with write access.
Clarify how `cache-mode` overrides affect access and why
`ignore-error=true` suppresses export failures without fixing denied
writes.
## Related issues or tickets
closes https://github.com/docker/build-push-action/issues/1571
Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
Update Gated Distribution docs with clearer conceptual info and runnable
API examples
- Added a new Distributor members section explaining the role/access
model — team-scoped pull-only access, member/repo isolation, and
guidance to provision a separate org to avoid consuming distributor
licenses. This folds in content Enablement shared as FAQs, reframed as
conceptual explanation rather than a Q&A list.
- Removed the "Key features" bullet list (it read like a marketing
callout out of place in a task-oriented access-management doc) and
merged the non-redundant points into the intro paragraph.
- Rewrote Invite distributor members via API with copy-pasteable curl
examples for every step (generate token, create team, grant repo access,
send bulk invites), chained via $TOKEN/$GROUP_ID so the whole flow can
be run end-to-end. UI vs. API alternatives are now presented as tabs
instead of nested bullets.
Preview:
https://deploy-preview-25933--docsdocker.netlify.app/docker-hub/repos/manage/access/#gated-distribution
## Related issues or tickets
ENGDOCS-3369
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Description
This PR is here to fix 7 broken markdown links with a missing
parenthesis, a stray bracket, and literal spaces that Hugo's link
resolver doesn't flag.
Feel free to provide any feedbacks 🚀
Craig Osterhout
Paweł Gronowski
David Karlsson
temenuzhka-thede
Sebastiaan van Stijn
Alexa KristensenandCursor
Dan Luhring
Allie Sadler
CrazyMax
docker-tools-robot
Sunshio