## Summary
The kit examples page covered tool installation and credential injection
but never showed how to customize the shell environment — sourcing a
tool's init script so its command lands on `PATH` in every shell. This
adds a "Customize the shell environment" section, documents
install-command gotchas that apply to any download-based kit, and fixes
a Vale rule that tripped on product names ending in `!`.
Two commits:
1. **docs: add shell environment customization to kit examples**
- Worked example uses **nvm** — it installs cleanly in a default sandbox
(reachable egress, no extra packages), so the snippet works as
copy-pasted. It appends to `/etc/sandbox-persistent.sh` — the sandbox's
persistent environment file, sourced for both interactive and
non-interactive shells — matching the FAQ convention for custom env
vars, and cross-links it.
- Install-command caveats added to the "Install a tool" section:
deny-by-default egress can silently block downloads; `curl … | bash`
masks those failures (exits `0`, sandbox reports success while nothing
installed); install steps run under `sh`, not bash; some tools need base
packages such as `zip`/`unzip`.
- The first draft's sdkman snippet was dropped as the primary example
because it fails silently in a default sandbox (blocked `get.sdkman.io`
egress + missing `zip`/`unzip`). Those failure modes are now documented
as general install-command guidance, with sdkman as the illustration.
2. **vale: exempt product names ending in '!' from Docker.Exclamation**
- `Docker.Exclamation` flags any word followed by `!` in bare prose,
tripping on product names like SDKMAN!. Link text and code were already
exempt via `IgnoredScopes`, but bare prose was not. Added an
`exceptions` list (matched against the word before the `!`) so genuine
exclamations are still caught.
## Learnings
- `/etc/sandbox-persistent.sh` is the canonical persistence point for
shell env in sandboxes — sourced before *every* bash invocation
(interactive and non-interactive), so it reaches agents started with
both `sbx run` and `sbx exec`. A `~/.bashrc` edit only covers
interactive shells.
- `curl … | bash` in an install command masks download failures: the
pipe's exit status is bash's, and bash exits `0` on empty input, so a
domain blocked by the deny-by-default egress policy still produces a "✓
Created" sandbox with nothing installed. Download-then-run (`-o file &&
bash file`) surfaces the failure.
- Kit install commands run under `sh` (dash), not bash — bash builtins
like `source` fail with `sh: source: not found` unless piped to `bash`
or wrapped in `bash -c`.
- nvm won't activate while `NPM_CONFIG_PREFIX` is set (the base image
sets it for its system Node); `unset NPM_CONFIG_PREFIX` before sourcing
`nvm.sh`.
- Vale's `exceptions` for an `existence` rule with `nonword: true` are
matched against the *word* preceding the non-word token, not the full
match — so a product name ending in `!` is listed without the `!`
(`SDKMAN`, not `SDKMAN!`). Go's RE2 engine also has no lookahead, so
token regexes can't use `(?=…)`.
Generated by Claude Code
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The sbx policy set-default command was renamed to sbx policy init in
the latest release. Update the non-interactive setup prose accordingly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The `sbx policy ls` rendering changed: a `Policy rules` status block
(Governance/Sync/Hidden), columns `PROVENANCE APPLIES_TO POLICY/RULE TYPE
DECISION RESOURCES`, and a `STATUS` column that appears only with
`--include-inactive`. Update the monitoring.md examples and column docs, and
fix the header/inactive-status prose in local.md and audit.md to match.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Description
Clarifies the OpenVEX status reference by documenting all four standard
OpenVEX status values.
Updates the introduction to clarify that OpenVEX defines four status
values
while Docker Hardened Images (DHI) uses three of them, and adds the
missing
`fixed` status to the reference table with a pointer to the explanation
below.
## Related issues or tickets
Fixes#25433
## Reviews
* [x] Technical review
* [ ] Editorial review
* [ ] Product review
## Summary
`docker/cagent-action` has moved to a new repository:
`docker/docker-agent-action`.
GitHub Actions `uses:` references must be updated explicitly, so this PR
migrates all references and pins them to
[v2.0.0](https://github.com/docker/docker-agent-action/releases/tag/v2.0.0).
- **New repository**: `docker/docker-agent-action`
- **Pinned commit**: `3c0fa9d282c3f84d08dfd70ab0a28b151d11db70`
- **Version**: `v2.0.0`
ℹ️ The old `docker/cagent-action` repo remains functional, so there is
no deadline — merge whenever convenient. New features and fixes land in
the new repo, which is where you'll want to be going forward.
> Auto-generated by the
[migrate-consumers](https://github.com/docker/docker-agent-action/actions/runs/28023540082)
workflow.
sbx v0.33.0 added linux/arm64 packages. Update the Linux prerequisites
to list aarch64 alongside x86_64, and extend the KVM module hint to
include kvm_arm64 and the bare kvm module used on some arm64 hosts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Fix misleading descriptions, stale tense, and contradictory statements
across admin, security, SSO, MCP profiles, and subscription scaling
documentation.
Closes#24893Closes#24894Closes#25024Closes#25058Closes#25261Closes#25300
Generated by Cursor (Claude)
Made with [Cursor](https://cursor.com)
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Description
Clarifies the wording in the "Persist the DB" workshop tutorial.
The volume is already created and named (`todo-db`) in step 1 using
`docker volume create`. The previous wording in step 3 suggested that
the volume was being named there, while the command actually uses the
existing volume as the mount source.
This change updates the wording to make the workflow clearer and more
technically accurate.
## Related issues or tickets
Fixes#25404
## Reviews
* [x] Technical review
* [ ] Editorial review
* [ ] Product review
## Description
Adds a note to the sandbox kit docs explaining that the sandbox manages
proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`,
and lowercase equivalents) for the agent, and that kits shouldn't set
them.
Setting these in a kit routes traffic around the sandbox's built-in
forward proxy, which silently disables network policy enforcement and
credential injection. The note points to the [Upstream
proxy](https://docs.docker.com/ai/sandboxes/architecture/#upstream-proxy)
section for configuring an upstream corporate proxy on the host, keeping
the env-var details in one place.
Surfaced as a documentation suggestion in
[docker/sbx-releases#240](https://github.com/docker/sbx-releases/issues/240).
## Reviews
- [ ] Technical review
- [ ] Editorial review
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Description
Fixes#25406.
Updates the Docker Desktop networking how-to so the Windows backend
process name matches the overview page: `com.docker.backend.exe`. The
same sentence also now closes the parenthetical process list before the
explanatory clause.
## Validation
- `git diff --check`
Not run: `docker buildx bake validate`, because Docker is not installed
in this environment.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
Fixes a broken link in Docker Desktop release notes.
The release notes referenced
`/desktop/windows/permission-requirements/`, which returns a 404 page.
This change updates the link to the current Windows permission
requirements documentation page.
## Related issues or tickets
Fixes#25401
## Reviews
* [x] Technical review
* [ ] Editorial review
* [ ] Product review
## Summary
- Add `useState` to the React import in the backend extension tutorial
code example — it was used but missing from the import, causing a
compilation error
- Remove the duplicate `createDockerDesktopClient()` call inside `App()`
— `ddClient` is already declared at module scope
## Issue
Fixes#25192
## Description
Fixes a broken relative link in
`content/manuals/admin/organization/organization-faqs.md`.
The FAQ linked to `convert-account.md` in the current directory, but the
file is located in the `setup/` subdirectory. Updated the link to point
to the correct path.
## Related issues or tickets
Fixes#25366
## Reviews
* [x] Technical review
* [ ] Editorial review
* [ ] Product review
David Karlsson
Mickael Emirkanian
Paweł Gronowski
Usha Mandya
Usha MandyaandClaude Opus 4.8
Devendra kushwah
Docker Agent
0xjg
Chris CroneandClaude Sonnet 4.6
Alexa KristensenandCursor
dependabot[bot]
Rob MurrayandClaude Opus 4.8
Craig Osterhout
Niels Kaspers
Sebastiaan van Stijn
github-actions[bot]
Harrison Crosse
Jasdeep Singh Bhalla