Docker Sandboxes

No entries match these filters. Clear filters

1. v0.51.0 Nov 3, 2026 · issue 130

   Docker Sandboxes adds custom mount targets, FUSEFUSEA Linux kernel interface that lets userspace programs implement a filesystem without kernel code, maintained as part of the kernel project; tools use it to mount virtual or synthetic filesystems without requiring root or kernel modules. filesystem support, stdin secret input, and new policy and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. controls in v0.51.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.51.0 https://github.com/docker/sbx-releases.git
   # already have the repo? check out this version:
   $ git checkout v0.51.0

   └──▷ TRY IT
   Keep secrets out of shell history by piping a token directly into a custom secret.
   copy

   $ echo 'my-token-value' | sbx secret set-custom --value-stdin

   Disable telemetry collection on a CI machine so neither the CLI nor the daemon reports usage.
   copy

   $ sbx settings set telemetry.disabled true && sbx daemon restart

   • Mount additional workspaces at custom paths by passing PATH:TARGET[:ro] to sbx create and sbx run, or setting additionalWorkspaces[].target in environment files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Start agents in a subdirectory with sbx run --workdir, including when reattaching to an existing sandbox.
   • Suppress creation progress output with sbx run --no-progress while still receiving command results, or use sbx create --no-progress for creation.
   • Read secrets from standard input with sbx secret set-custom --value-stdin, keeping secret values out of command arguments.
   • Enable FUSE filesystems in local sandboxes via the sandbox.fuse setting or the environment option sandboxOptions.fuse.

   +5 more show less

   • Check HTTP governance policy behavior with the new sbx policy check http command.
   • Disable local CLI and daemon telemetry persistently with sbx settings set telemetry.disabled true; run sbx daemon restart to apply to a running daemon.
   • Prefix MCP tool names with their server name by enabling mcp.useServerNamePrefixes.
   • Use static MCP mode without attaching servers by passing --static-mcp none to sbx create or sbx run.
   • Disable the bundled model server and its inference-runtime download by setting model.server.enabled to false and running sbx daemon restart.

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Built-in agent names now resolve to published kits at docker.io/sbx/<name>:latest; the kit.allowExtractedAgents setting is removed.
   • !Sandboxes created from embedded Claude or Codex specifications must be recreated before using sbx kit add, sbx run --model, or sbx move — save files and unpushed commits before removing.
   • !The shell agent now uses a published Debian 13 v3 kit and requires registry access on first use; add the shell-credentials mixin to provide provider credentials.
   • !V1 and v2 kits cannot be combined with v3 kits — older mixins must be upgraded to v3 before combining with the new built-in kits.
   • !The docker/sandbox-templates images for codex, cursor-agent, devin, docker-agent, and opencode (including -docker variants) are no longer published.
   • !The docker/sandbox-templates:shell and :shell-docker images are no longer refreshed; use docker.io/sbx/shell-image and docker.io/sbx/shell-docker-image for custom workloads.
   • !Copying text from a local sandbox to the host clipboard now requires opting in with the clipboard.textCopy setting.
   • !Custom secrets without destination hosts no longer substitute credentials — existing mappings must be repaired by adding explicit destination hosts while preserving their placeholders and other settings.
2. v0.50.0 Oct 26, 2026 · issue 122

   Docker Sandboxes v0.50.0 adds cloud sandbox inspection, configurable kit host mounts, persistent kit volumes, and HTTP query-parameter network rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.50.0 https://github.com/docker/sbx-releases.git
   # already have the repo? check out this version:
   $ git checkout v0.50.0

   └──▷ TRY IT
   Inspect a specific cloud sandbox and get its published port URLs in machine-readable form for scripting or CI pipelines.
   copy

   $ sbx --cloud inspect my-sandbox --format json

   Create a sandbox and bind a host directory to a kit-declared mount target so the agent can read/write a specific host path.
   copy

   $ sbx create --mount /home/user/project:/workspace/project my-kit

   Restrict outbound HTTP access to requests that include specific query parameters, useful for scoping API calls to a known tenant or environment.
   copy

   $ sbx run --query api_key=allowed --query env=prod my-kit

   • Adds sbx --cloud inspect <id|name> to show details for a single cloud sandbox, including published port URLs; supports --format json and --format yaml for scripting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --mount HOST:SANDBOX_PATH flag to sbx create and sbx run for selecting a host directory for a kit-declared host mount; environment files support the same bindings through mounts.
   • Adds --query name=value flag (repeatable) to HTTP network rules to require specific query-parameter restrictions.
   • Adds --skip-host-commands flag to disable Environment MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. host-execution commands for a sandbox.
   • Persistent kit volumes now retain data across kit updates and sandbox removal and recreation with the same name.

   +5 more show less

   • sbx exec now returns exit status 125 when it cannot run the command (e.g. sandbox does not exist).
   • sbx cp rejects symbolic links that escape a sandbox workspace when reached through an alternate host path, including a symlink, junction, macOS /private/tmp, or a Linux bind mount of a workspace subdirectory.
   • Sandboxes created with --clone now preserve kit-provided workspace files and report clone initialization failures.
   • On macOS and Windows, sbx diagnose and daemon logs warn when SSL_CERT_FILE or SSL_CERT_DIR replaces the system trust store.
   • Gordon clears Approve all and Always allow grants when a conversation resumes, requiring fresh approval before running tools again.
   • Adds sbx --cloud inspect <id|name> to show details for a single cloud sandbox, including published port URLs; supports --format json and --format yaml for scripting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --mount HOST:SANDBOX_PATH flag to sbx create and sbx run for selecting a host directory for a kit-declared host mount; environment files support the same bindings through mounts.
   • Adds --query name=value flag (repeatable) to HTTP network rules to require specific query-parameter restrictions.
   • Adds --skip-host-commands flag to disable Environment MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. host-execution commands for a sandbox.

   6 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !Windows: older elevated daemons must be stopped with the previous CLI or Task Manager before using the updated CLI, because the updated CLI verifies that the daemon's named pipes belong to the same Windows user.
   • !Each local source kit rebuilds once after upgrading, because local source kits are now reused only when their digests match recorded local builds.
   • !Existing sandbox records retain their previous storage behavior — persistent kit volumes only apply to sandboxes created with v0.50.0 or later.
3. docs update Oct 22, 2026 · issue 116

   Adds proxy.sshDirect config setting to bypass the upstream proxy for cloud SSH connections in Docker Sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   When your network proxy blocks the SSH gateway port, bypass it for cloud SSH while keeping other CLI traffic routed through the proxy.
   yaml copy

   proxy.sshDirect: true

4. docs update Oct 22, 2026 · issue 116

   Docker Sandboxes gains browser-blocking, daemon log rotation controls, and a per-connection SSH proxy bypass setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Lock down a sandbox so it cannot open host browser tabs or trigger OAuth redirect flows during automated runs.
   yaml copy

   browser.enabled: false

   Tune daemon log rotation so logs rotate at 50 MB, keep at most 5 backups, and are purged after 30 days — whichever limit is hit first.
   yaml copy

   daemon.log.maxSizeMB: 50
   daemon.log.maxBackups: 5
   daemon.log.maxAgeDays: 30

   Route cloud SSH connections directly, bypassing the upstream proxy, without restarting the daemon — useful when the proxy blocks SSH tunnels.
   yaml copy

   proxy.sshDirect: true

   • Adds browser.enabled config key to prevent sandboxed processes from opening URLs in the host browser and block in-sandbox OAuth logins that redirect to localhost.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds daemon.log.maxSizeMB config key to set the MB threshold at which the daemon log rotates (minimum enforced).
   • Adds daemon.log.maxBackups config key to cap the number of rotated daemon logs kept; a value of 0 removes the count limit while the age limit still applies.
   • Adds daemon.log.maxAgeDays config key to set how many days rotated daemon logs are retained; a value of 0 removes the age limit while the backup count limit still applies.

   4 details in Everything

5. announced Oct 21, 2026 · issue 116

   Docker Sandboxes adds sbx secret set-custom and sbx policy allow network flags plus a band.yaml kit config to connect isolated sandbox agents to multi-agent BAND rooms.

   • New integrationAdds docker.io/bandhq/band-python-kit:latest (current published tag 6.0.0) as a Docker Sandbox kit, enabling sandboxed agents to connect to BAND AI rooms via outbound WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. with one sbx create command.
   • Supports band.yaml config file in the sandbox workspace to declare which agent entrypoint (agent.id, Python file) the BAND kit launches on sbx run.
   • Adds sbx secret set-custom with --sandbox, --host, --env, and --placeholder flags to scope per-sandbox credentials (e.g. BAND_API_KEY, ANTHROPIC_PROXY_KEY) to specific outbound hosts without exposing real keys inside the microVM.
   • Adds sbx policy allow network --sandbox <name> <host> to grant a named sandbox outbound access to specific API hosts (e.g. api.anthropic.com).
   • Enables multi-agent BAND room composition where sandboxed local agents and hosted agents collaborate via @mentions, shared message history, and tool-execution events visible to human participants.

   5 details in Everything

6. v0.49.1 Oct 20, 2026 · issue 115

   Docker Sandboxes v0.49.1 adds offline kit validation, proxy-aware cloud commands, richer CLI diagnostics, and new daemon log settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.49.1 https://github.com/docker/sbx-releases.git
   # already have the repo? check out this version:
   $ git checkout v0.49.1

   └──▷ TRY IT
   Validate a local kit archive before deploying, without starting the daemon or authenticating — useful in CI.
   copy

   $ sbx kit validate --offline ./my-kit.zip

   Cap daemon logs to 50 MB per file, keep 5 backups, and expire files older than 30 days to prevent disk fill on long-running hosts.
   copy

   $ sbx settings set daemon.log.maxSizeMB=50 daemon.log.maxBackups=5 daemon.log.maxAgeDays=30

   Force cloud SSH through a direct connection on a corporate network that allows outbound SSH, bypassing the HTTP proxy.
   copy

   $ sbx settings set proxy.sshDirect=true

   • sbx kit validate and sbx kit inspect now accept --offline to check a local directory or ZIP kit without starting the daemon or signing in; sandboxes created from local or Git v3 kits now honor build-time --kit-arg values, including scoped overrides; sbx kit sign warns when Git would change the signed file contents and invalidate signatures for git+ references; and sbx settings set rejects incorrectly structured values for kit.allowedSources and kit.trustedSigners before saving them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds daemon.log.maxSizeMB, daemon.log.maxBackups, and daemon.log.maxAgeDays keys to sbx settings set for controlling daemon log size and retention, the browser.enabled setting to control whether sandboxes can open the host browser, and the proxy.sshDirect setting (set to true) to connect cloud SSH directly on networks that permit direct SSH connections.
   • sbx policy ls, sbx settings ls, and sbx policy approval ls now accept -q to print only rule IDs, setting keys, or approval IDs.
   • sbx policy refresh immediately refreshes policy instead of waiting for the next polling interval.
   • sbx secret rm now returns an error when no secret matches --registry, --placeholder, --host, or --env-name, and sbx secret set-custom warns before replacing a different host or environment-variable mapping under the same placeholder.

   +5 more show less

   • sbx diagnose now reports running CLI and shim processes, warns when global network policy is not initialized, and detects a ZFS setting that can make image builds unusually slow.
   • sbx env reports unknown keys and invalid values with their source file, line, column, and field.
   • sbx mcp add now completes OAuth discovery on networks that require an HTTP proxy without needing --skip-ssrf-check, and cloud commands, sbx move, the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency., and cloud SSH now honor configured proxies, including system and PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. proxies.
   • Full templates now include a C/C++ toolchain for compiling native code inside the sandbox.
   • The Linux tarball installer now works for regular users on systems with AppArmorAppArmorA Linux kernel security module, maintained as part of the kernel, that confines programs to a declared set of files, capabilities, and network access — letting cyber tools sandbox processes without writing custom kernel code..
   • sbx kit validate and sbx kit inspect now accept --offline to check a local directory or ZIP kit without starting the daemon or signing in; sandboxes created from local or Git v3 kits now honor build-time --kit-arg values, including scoped overrides; sbx kit sign warns when Git would change the signed file contents and invalidate signatures for git+ references; and sbx settings set rejects incorrectly structured values for kit.allowedSources and kit.trustedSigners before saving them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds daemon.log.maxSizeMB, daemon.log.maxBackups, and daemon.log.maxAgeDays keys to sbx settings set for controlling daemon log size and retention, the browser.enabled setting to control whether sandboxes can open the host browser, and the proxy.sshDirect setting (set to true) to connect cloud SSH directly on networks that permit direct SSH connections.

   8 more in Everything

7. announced Oct 14, 2026 · issue 109

   Harbor eval framework integrates with Docker Sandboxes, enabling isolated microVM agent evals locally or in the cloud via sbx engine.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run an agent eval task in Docker Cloud Sandboxes to get isolated microVM execution without managing infrastructure.
   copy

   $ export SBX_DOCKER_USERNAME="your-docker-id"
   export SBX_DOCKER_PAT="your-personal-access-token"
   harbor run -t hello-world/hello-world -a oracle -e sbx

   Run the same eval task locally on a laptop using the Docker Sandboxes CLI backend, keeping the workflow identical to cloud runs.
   copy

   $ sbx login
   harbor run -t hello-world/hello-world -a oracle -e sbx --ek target=local

   • Adds harbor[sbx] install target to run Harbor eval tasks inside Docker Sandboxes microVM environments via uv tool install 'harbor[sbx]'.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds -e sbx engine flag to harbor run to execute eval tasks in Docker Sandboxes instead of plain containers.
   • Adds --ek target=local extended-key argument to harbor run to direct tasks to a local Docker Sandboxes instance instead of Cloud Sandboxes.
   • Adds SBX_DOCKER_USERNAME and SBX_DOCKER_PAT environment variables for authenticating Harbor with Docker Cloud Sandboxes.
   • Supports configurable network policies per eval task, allowing internet access during setup to be cut off during agent execution for reproducible evals.

   +1 more show less

   • Supports Docker Cloud Sandboxes as a cloud backend, enabling up to 64 concurrent parallel eval workers without manual machine provisioning.

   6 details in Everything

8. v0.48.0 Oct 13, 2026 · issue 107

   v0.48.0 adds managed Codex/Claude Desktop SSH targets, v3 kit capabilities, and a unified --format output system with breaking CLI changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.48.0 https://github.com/docker/sbx-releases.git
   # already have the repo? check out this version:
   $ git checkout v0.48.0

   └──▷ TRY IT
   Register a dedicated Codex and Claude Desktop sandbox on macOS or Windows so AI coding agents connect via SSH without a host workspace mounted.
   copy

   $ sbx setup ssh --auto-create

   Detach a loaded MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server from a running sandbox without restarting its agent — useful when swapping MCP configurations mid-session.
   copy

   $ sbx mcp unload my-server --sandbox my-sandbox

   Parse sandbox names from sbx ls JSON in a script after the output structure changed from a wrapped object to a bare array.
   copy

   $ sbx ls --format json | jq '.[].name'

   • Adds --format table, --format json, --format yaml, and --format github-issue to sbx diagnose (replacing the old --output / -o flag) and --format json/--format yaml to sbx prune --dry-run for structured dry-run output; --format json and --format yaml are now mutually exclusive with --json and -q, and unsupported format values fail at flag-parse time instead of silently falling back to human-readable output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --detach / -d to sbx run and sbx env run as the replacement for --detached, --no-progress to sbx create as the replacement for --quiet / -q (suppressing progress while still printing the creation summary), and --env-name to sbx secret ls and sbx secret rm as the replacement for --env.
   • Adds sbx setup ssh --auto-create on macOS and Windows to register Docker Sandbox connections in Codex and Claude Desktop, creating a dedicated sandbox on first use.
   • Adds sbx mcp unload NAME --sandbox SANDBOX to detach a loaded MCP server without restarting the sandbox's agent.
   • Adds --ttl and --on-timeout restart support to sbx move --to cloud and sbx --cloud env create, extending always-on timeout control beyond sbx --cloud create.

   +4 more show less

   • Adds SBX_AGENT environment variable inside sandbox containers, exposing the provisioned agent's name for kit hooks and scripts.
   • Adds sbx kit add support for kits with startup commands (running after the kit is added and on each subsequent sandbox start), V3 kit support for capability groups, kit.env references, bundled agent skills, and the ssh-agent@1 and git-identity@1 capabilities, and sbx kit validate rejection of kits whose credentials route the same host, identifying the conflicting services.
   • Sandbox-scoped custom secrets can now override global secrets that share the same environment variable name.
   • SSH-agent forwarding supports Windows OpenSSH and 1Password agents when SSH_AUTH_SOCK is not set.
   • Adds --format table, --format json, --format yaml, and --format github-issue to sbx diagnose (replacing the old --output / -o flag) and --format json/--format yaml to sbx prune --dry-run for structured dry-run output; --format json and --format yaml are now mutually exclusive with --json and -q, and unsupported format values fail at flag-parse time instead of silently falling back to human-readable output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds sbx setup ssh --auto-create on macOS and Windows to register Docker Sandbox connections in Codex and Claude Desktop, creating a dedicated sandbox on first use.
   • Adds sbx mcp unload NAME --sandbox SANDBOX to detach a loaded MCP server without restarting the sandbox's agent.
   • Adds SBX_AGENT environment variable inside sandbox containers, exposing the provisioned agent's name for kit hooks and scripts.

   5 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !--detached on sbx run and sbx env run is rejected; replace with --detach or -d.
   • !--yes / -y on sbx logout is rejected; replace with --force or -f.
   • !--auto-approve / -y on sbx env plan, sbx env create, and sbx env run is rejected; replace with --force or -f.
   • !--quiet / -q on sbx create is rejected; replace with --no-progress.
   • !-d (short for description) on sbx template save is rejected; replace with --description.
   • !--output / -o on sbx diagnose is rejected; replace with --format table, --format json, --format yaml, or --format github-issue.
   • !--env on sbx secret ls and sbx secret rm is rejected; replace with --env-name.
   • !--quiet / -q on sbx policy log is removed with no replacement.
   • !--format, --json, and -q are mutually exclusive; even --json --format json is rejected.
   • !Unsupported --format values now fail at flag-parse time instead of falling back to human-readable output.
   • !sbx ls --json output changes: the top-level object {"sandboxes": [...]} is replaced by a bare array; update filters from .sandboxes[].name to .[].name. Fields are now snake_case, created_at and last_used_at use RFC 3339 timestamps, and rows include detached.
   • !sbx template ls --json output changes: top-level {"images": [...]} is replaced by a bare array for local and cloud sandboxes.
   • !sbx mcp ls --json locally: top-level {"gateway": {...}, "servers": [...]} is replaced by a bare server array; each row carries gateway.
   • !sbx policy log output changes: local allowed_hosts / blocked_hosts and cloud camelCase fields are replaced by {updated_at, allowed: [...], blocked: [...]} with entries containing sandbox_id, host, proxy_type, rule, reason, count, first_seen, and last_seen.
   • !sbx --cloud policy ls field names change from camelCase to snake_case.
   • !sbx ports cloud rows rename port to sandbox_port; local rows use host_ip, host_port, sandbox_port, and protocol.
   • !sbx ports --publish / --unpublish locally: structured formats now emit result rows with action: published or action: unpublished; warnings go to stderr.
   • !Cloud volume create, volume ls, and volume inspect field names change from PascalCase (ID, Name, CreatedAt) to snake_case (id, name, created_at). volume inspect now defaults to a human-readable details view; use --format json for JSON.
   • !sbx rm, sbx stop, sbx template rm, sbx volume rm structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. now returns an array of result objects with action, resource, name, and optional id and error; actions are lowercase strings.
   • !Confirmation prompts require terminal input; piping an answer (e.g. echo y | sbx secret set ...) no longer confirms the operation — use --force / -f instead.
   • !Declining a confirmation now returns a non-zero exit status consistently for removal, reset, and prune operations.
   • !Read-only invocations and runs with --force no longer start an interactive sign-in flow; authentication must be completed before running automation.
   • !Without a terminal, sbx diagnose --upload saves the diagnostic bundle but skips uploading and exits with status 0 — a zero exit no longer guarantees an upload occurred.
   • !Without a terminal, sbx create and sbx run fail if the workspace directory does not exist (a mkdir -p hint is printed).
   • !Ctrl-D at a selection or free-text prompt now cancels instead of accepting the default.
9. docs update Oct 6, 2026 · issue 096

   Docker Sandboxes cloud CLI gains --rm flag to auto-remove sandboxes on agent exit and surfaces ttl_paused in JSON output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Automatically clean up a cloud sandbox after a Claude agent session ends, avoiding orphaned sandboxes piling up.
   copy

   $ sbx --cloud run --rm claude

   Check whether a sandbox's TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. is paused (stopped) in a script by inspecting the ttl_paused field in JSON output.
   copy

   $ sbx --cloud ttl --json | jq '.ttl_paused'

   • Adds --rm flag to sbx --cloud run to automatically remove the sandbox when the agent session ends, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ sbx --cloud run --rm claude.
   • Adds ttl_paused field to --json output so callers can detect whether a sandbox is stopped and its time-to-livetime-to-liveTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. is paused.
   • Adds sbx --cloud ttl reporting for stopped sandboxes, showing stopped instead of an expiration time while the sandbox is paused.
   • Adds --rm flag to sbx --cloud run to automatically remove the sandbox when the agent session ends, e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ sbx --cloud run --rm claude.

   2 more in Everything

10. docs update Oct 6, 2026 · issue 096

    Docker Sandboxes adds --rm for throwaway sessions and --detached/-d to keep sandboxes running in the background.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a throwaway Claude sandbox that is automatically cleaned up when the agent exits — useful in CI or one-off investigations.
    copy

    $ sbx run --rm claude

    Start a long-lived sandbox in the background (e.g. to serve an application on a published port) and get its ID back immediately.
    copy

    $ sbx run -d --name my-project claude .

    • Adds --rm flag to sbx run to automatically remove the sandbox when the agent exits, without a confirmation prompt (exit status is preserved; incompatible with --detached and --detach-keys).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --detached / -d flag to sbx run to start a sandbox in the background, printing its ID and returning immediately without opening an agent session.
    • Passing --detached / -d against an existing sandbox with sbx run -d --name <sandbox-name> permanently switches it to detached mode.

    3 details in Everything

11. v0.47.0 Oct 5, 2026 · issue 095

    Docker Sandboxes v0.47.0 adds sbx run --rm auto-cleanup, long-running kit capability, and richer cloud TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.47.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.47.0

    └──▷ TRY IT
    Run an agent session in a cloud sandbox and have it automatically cleaned up when the session ends — useful in CI pipelines where you want no leftover sandboxes.
    copy

    $ sbx run --rm --cloud my-agent-sandbox

    Declare the long-running capability in a kit so local sandboxes it provisions stay alive after agents disconnect, letting the next session reconnect without a cold start.
    yaml copy

    capabilities:
      - com.docker.sandbox/long-running@1

    Re-authenticate an existing MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server connection to obtain a refresh tokenrefresh tokenA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. now that offline_access is requested automatically.
    copy

    $ sbx mcp auth

    • Adds sbx run --rm to automatically remove a local or cloud sandbox after its agent session ends (cannot be combined with --detached; cloud sandboxes interrupted by a dropped connection are kept and the CLI prints the removal command).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds com.docker.sandbox/long-running@1 kit capability declaration to keep local sandboxes running after all sessions disconnect (cloud sandboxes and sbx kit add cannot provide this capability: required entries are rejected, optional entries are skipped).
    • Adds stopped and ttl_paused fields to sbx --cloud ttl JSON output; stopped sandboxes are reported as stopped instead of expired, and the TTL restarts on resume.
    • sbx settings set now rejects invalid upstream proxy values before saving them.
    • Host-port collisions from sbx ports --publish now identify the occupied binding and offer a retry with an automatically allocated port.

    +4 more show less

    • MCP authorization requests offline_access when the server advertises it and authorization uses saved defaults or resource-required scopes, enabling servers to issue refresh tokensrefresh tokensA credential used to obtain a new access token without signing in again. It is sent to the authorization service rather than used directly to call the protected API. (run sbx mcp auth again to obtain a grant with a refresh token for existing credentials).
    • sbx kit sign and sbx kit push --sign now succeed on registries that refuse manifest deletion, including GitHub Container Registry and Docker Hub.
    • Kit pulls now enforce limits on registry-declared blob sizes, decompressed content, and archive entry counts.
    • Creating or moving a sandbox to the cloud now applies cloud policy and the kit's network rules without copying locally added network rules; moving a sandbox with local HTTP method or path restrictions warns that those restrictions will not apply in the cloud.
    • Adds sbx run --rm to automatically remove a local or cloud sandbox after its agent session ends (cannot be combined with --detached; cloud sandboxes interrupted by a dropped connection are kept and the CLI prints the removal command).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds com.docker.sandbox/long-running@1 kit capability declaration to keep local sandboxes running after all sessions disconnect (cloud sandboxes and sbx kit add cannot provide this capability: required entries are rejected, optional entries are skipped).

    7 more in Everything

12. announced Oct 1, 2026 · issue 093

    Docker Cloud Sandboxes launch: run agent tasks in isolated microVMs on Docker-managed cloud compute using the sbx CLI⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ▶ ⤢

    ▶ ⤢

    ▶ ⤢
    • Introduces Docker Cloud Sandboxes, which run each agent task in an isolated microVM with its own kernel and Docker daemon on Docker-managed cloud compute, billed by the second.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Supports the sbx command-line tool for starting, moving, and retrieving sandboxes between local and cloud environments, so longer agent tasks can continue after closing a laptop.
    • Introduces the Docker Sandbox Kit specification — an OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image format containing an agent, its tools, and declared access requirements — enabling teams to build, push, pull, scan, and pin agent environments by digest.
    • Supports sbxenv files, which describe a set of sandbox environments as configuration for reproducing agent environments across machines.
    • Publishes the Sandbox Kit specification under Apache 2.0 and commits to CNCF neutral governance, with Docker Sandboxes as the first runtime implementation.

    +3 more show less

    • Supports Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. (MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface.) for connecting tools to agents running inside sandboxes.
    • Enforces a runtime proxy that can supply credentials to a sandbox without exposing the raw API key inside the agent environment.
    • Provides an audit view that records policy decisions — including blocked network destinations — so developers can inspect agent activity after a task completes.

    8 details in Everything

13. docs update Sep 29, 2026 · issue 089

    Docker Sandboxes adds sbx daemon restart to reload model provider API keys and runtime changes without a full restart.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Adds sbx daemon restart command to reload the daemon after setting or changing a model provider API key or adding llama-server to the host PATH.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • The Docker Sandboxes daemon manages a persistent model service that starts at daemon startup, survives individual sandbox or CLI exits, and lets sandboxes share a common model store and loaded models.

    2 details in Everything

14. docs update Sep 29, 2026 · issue 089

    Docker Sandboxes adds --kit-arg and --kit-args-file flags to sbx --cloud create for parameterizing v2 kit mixins.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Parameterize a v2 kit mixin inline when creating a cloud sandbox — useful when you need to pin a specific version of a bundled CLI tool.
    copy

    $ sbx --cloud create --name cloud-tools claude --kit docker.io/<NAMESPACE>/company-cli:1.0.0 --kit-arg company-cli.version=1.2

    Load kit arguments from a file to keep sandbox creation commands tidy and repeatable across CI pipelines.
    copy

    $ sbx --cloud create --name cloud-tools claude --kit docker.io/<NAMESPACE>/company-cli:1.0.0 --kit-args-file kit-args.txt

    • Adds --kit-arg flag to sbx --cloud create to pass named arguments (in name=value form) to v2 kit mixins at sandbox creation time.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

15. v0.46.0 Sep 28, 2026 · issue 089

    Docker Sandboxes v0.46.0 adds restart-on-timeout for cloud sandboxes, kit-arg passthrough, and richer CLI diagnostics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.46.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.46.0

    └──▷ TRY IT
    Keep a long-running cloud sandbox alive indefinitely by auto-restarting it the moment it hits its time limit.
    copy

    $ sbx --cloud create --on-timeout restart --kit my-agent-kit

    Pass kit-specific configuration values when creating a cloud sandbox, so the kit can customize its behaviour at launch.
    copy

    $ sbx --cloud create --kit my-agent-kit --kit-arg model=gpt-4o --kit-arg max_steps=50

    Fail a CI step immediately if a diagnostics upload is unsuccessful, rather than silently succeeding.
    copy

    $ sbx diagnose --upload || echo 'Diagnostics upload failed — check connectivity and retry'

    • Adds --on-timeout restart to sbx --cloud create so a sandbox that hits its time limit stops and immediately restarts instead of remaining stopped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --kit-arg and --kit-args-file flags to sbx --cloud create for passing values to kits supplied with --kit.
    • Adds sbx diagnose --upload returning a non-zero exit status on failed diagnostics uploads, enabling reliable script-level failure detection.
    • Adds runtime_socket_limit_bytes field to sbx diagnose output, reporting the socket-path length limit used by the container runtime.
    • sbx env reports unrecognized environment-file keys with the file, line, and column where they were declared, including across merged files.

    +6 more show less

    • Kits can now install files in the agent's skills directory when shared skills are read-only, without triggering a read-only filesystem error.
    • Kits added through the runtime API retain their network rules and applicable agent instructions when another kit addition recreates the sandbox container.
    • sbx kit add warns if it cannot save the updated sandbox record, explaining which kit settings could be lost and the conditions that would cause the loss.
    • Image paste in WSL2WSL2A Microsoft-maintained compatibility layer in Windows 10/11 that runs a real Linux kernel inside a lightweight VM, letting cyber tools built for Linux execute natively on Windows without dual-booting or a full VM. falls back to the Windows clipboard when Linux clipboard tools return no image, requiring clipboard.imagePaste to be enabled.
    • Sandboxes created with the balanced network policy preset can now download Playwright browser binaries from cdn.playwright.dev over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate..
    • Removing secrets in bulk now revokes credentials from running sandboxes, with failed revocations retryable even after stored secrets have been deleted.
    • Adds --on-timeout restart to sbx --cloud create so a sandbox that hits its time limit stops and immediately restarts instead of remaining stopped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --kit-arg and --kit-args-file flags to sbx --cloud create for passing values to kits supplied with --kit.

    9 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !Secret commands configured with sbx secret set --command, sbx secret set-custom --command, or secrets.<name>.command in an environment file now execute from a fresh temporary directory on the host. Relative paths such as ./credential-helper no longer resolve from the project directory or the directory where you ran sbx. Existing environments that declare secret commands will be prompted to approve a one-time plan change for the working directory on the next sbx env run. The execution change takes effect immediately after upgrading and restarting the daemon, even before that plan is approved.
16. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes adds cloud environment file support via sbx --cloud env with plan, run, and removal workflows⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Preview a cloud sandbox plan and then launch it detached — useful in CI where you want approval before provisioning and no interactive terminal.
    copy

    $ sbx --cloud env plan ./cloud.sbxenv.yaml
    sbx --cloud env run --detached ./cloud.sbxenv.yaml

    Define a cloud sandbox environment file with resource limits and a project-scoped environment variable, then run a command inside it.
    cloud.sbxenv.yaml copy

    # cloud.sbxenv.yaml
    project: cloud-project
    memory: 4g
    env:
      PROJECT_NAME: example

    Clean up a cloud sandbox and its provisioned secrets when an unattended run is complete.
    copy

    $ sbx --cloud env rm ./cloud.sbxenv.yaml

    • Adds sbx --cloud env plan <file> to preview a cloud sandbox configuration before provisioning, including inherited cloud credentials.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx --cloud env run --detached <file> to create a cloud sandbox from an environment file without attaching to it.
    • Adds sbx --cloud env rm <file> to tear down a cloud sandbox and remove only the secrets provisioned by that environment file.
    • Adds sbx --cloud env <file> subcommand for managing cloud sandboxes from a .sbxenv.yaml environment file, supporting agents, kits, environment variables, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware./memory limits, and provider credentials.
    • Adds snapshot: true on a credential entry to resolve a host command or vault reference once and store the result as a literal secret, preventing dynamic refresh.

    +2 more show less

    • Supports DOCKER_ACCESS_TOKEN environment variable to scope cloud environment state to a specific Docker identity, with a token change starting a separate state scope.
    • Adds sbx --cloud cp for transferring project files into a cloud sandbox as an alternative to cloning a repository inside the sandbox.

    7 details in Everything

17. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes: Supports GitHub Copilot models in OpenCode by configuring a GitHub credential — no separate device login required inside the sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    • Selects a local model or inference endpoint via sbx run --model, with the model's supported thinking levels available as OpenCode variants cycled using Ctrl+T.

    1 detail in Everything

18. docs update Sep 25, 2026 · issue 085

    New sbx move command transfers filesystem snapshots between local and cloud Docker sandboxes in either direction.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Move a local sandbox to the cloud with a 2-hour TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and stop-on-expiry so work is preserved rather than deleted.
    copy

    $ sbx move local-project --to cloud --name cloud-project --ttl 2h --on-timeout stop

    Pull a cloud sandbox back to local for offline work, then verify both environments and check port bindings on the new local copy.
    copy

    $ sbx move cloud-project --to local --name local-copy && sbx --cloud ls && sbx ports local-copy

    • Adds sbx move <sandbox> --to cloud to transfer a local sandbox filesystem snapshot to a cloud sandbox, creating a new cloud sandbox from the captured image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx move <sandbox> --to local to transfer a cloud sandbox filesystem snapshot to a local sandbox, importing the snapshot and creating a local sandbox.
    • Adds --name flag to sbx move to set the destination sandbox name prefix (cloud destinations append a short unique suffix).
    • Adds --ttl flag to sbx move to set expiration time on the cloud destination sandbox (defaults to server default, typically one hour).
    • Adds --on-timeout stop and --on-timeout delete flags to sbx move to control expiration behavior on the cloud destination.

    +3 more show less

    • Adds --force flag to sbx move to skip confirmation prompts when local workspace mounts or local HTTP network restrictions are present on the source.
    • Supports --platform linux/amd64 and --platform linux/arm64 on the cloud source sandbox to ensure platform compatibility before a cloud-to-local move.
    • sbx move performs a pre-transfer compatibility check to verify the destination supports the source sandbox's platform before transferring the snapshot.

    8 details in Everything

19. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes gains cloud network policy management via sbx --cloud policy with account and sandbox scopes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Lock down all outbound traffic for your cloud sandboxes by default, then carve out only the endpoints your AI agent actually needs.
    copy

    $ sbx --cloud policy init deny-all
    sbx --cloud policy allow network api.github.com:443
    sbx --cloud policy allow network api.anthropic.com:443

    Create a new cloud sandbox with network rules baked in at creation time, so no post-creation policy steps are needed in CI.
    copy

    $ sbx --cloud create --name cloud-project \
      --allow-network api.github.com:443 \
      --deny-network example.com claude

    Audit what network connections a sandbox is actually making and whether policy allowed or denied them.
    copy

    $ sbx --cloud exec cloud-project curl -I https://api.github.com
    sbx --cloud policy log cloud-project

    • Adds sbx --cloud policy init to set the outbound network default for cloud sandboxes to allow-all, balanced, or deny-all at the Docker account scope.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx --cloud policy init deny-all --sandbox <sandbox> to set a deny-all default scoped to a single cloud sandbox.
    • Adds sbx --cloud policy allow network <host:port> and sbx --cloud policy allow network <host:port> --sandbox <sandbox> to create account-level or sandbox-scoped outbound allow rules.
    • Adds sbx --cloud policy ls and sbx --cloud policy ls <sandbox> to inspect the configured account or sandbox network policy document.
    • Adds sbx --cloud policy log <sandbox> to review per-sandbox cloud network policy enforcement decisions.

    +3 more show less

    • Adds sbx --cloud policy rm network --resource <host:port> and --sandbox <sandbox> to remove individual allow or deny rules by pattern.
    • Adds sbx --cloud policy reset (with --force for scripted use) to remove custom account policy rules and return to the platform default.
    • Introduces a separate cloud-only policy store with account and individual sandbox scopes, where deny rules take precedence over allow rules across all applicable policies.

    8 details in Everything

20. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes adds cloud secret store for agent credentials via sbx --cloud secret with per-sandbox and account-scoped support⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Store an Anthropic API key in the cloud secret store, then launch a Claude Code agent in a named cloud sandbox — keeping credentials out of the sandbox filesystem.
    copy

    $ sbx --cloud secret set anthropic
    sbx --cloud run claude --name cloud-project

    Inject a custom API credential for a non-built-in service so the cloud proxy sets the Authorization header on all requests to that host.
    copy

    $ sbx --cloud secret set-custom --name project-api \
      --host api.example.com --env PROJECT_API_TOKEN \
      --header Authorization --format 'Bearer %s'

    Scope an OpenAI API key to a single sandbox so it takes precedence over any account-scoped credential, then remove it without an interactive prompt in CI.
    copy

    $ sbx --cloud secret set openai --sandbox cloud-project
    # later, in a cleanup script:
    sbx --cloud secret rm openai --sandbox cloud-project --force

    • Adds sbx --cloud secret set anthropic to store an Anthropic API key in the cloud secret store for Claude Code agents.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx --cloud secret set openai --oauth to complete an OpenAI OAuth flow and store the resulting credential at account scope for Codex.
    • Adds sbx --cloud secret set openai to store an OpenAI API key for Codex in the cloud secret store.
    • Adds sbx --cloud secret set <service> to configure API keys or tokens for built-in services (anthropic, cursor, droid, github, google, groq, mistral, nebius, openai, openrouter, xai) in the cloud secret store.
    • Adds --sandbox <name> scope flag to sbx --cloud secret set to restrict a credential to a single named sandbox, taking precedence over the default account-scoped credential for the same service.

    +3 more show less

    • Adds sbx --cloud secret set-custom with --name, --host, --env, --header, and --format flags to inject arbitrary API credentials for non-built-in services via cloud proxy header injection.
    • Adds sbx --cloud secret ls to list cloud secret metadata without exposing values.
    • Adds sbx --cloud secret rm <service> (with optional --sandbox <name> or --host <host>) and --force flag to remove cloud credentials non-interactively in scripts.

    8 details in Everything

21. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes gains a --cloud flag for sbx commands, enabling cloud-managed sandboxes with persistent volumes, SSH, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, and port exposure.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a long-running agent task unattended in a cloud sandbox with 4 CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and 8 GiB RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed., then clean up automatically — useful in CI pipelines.
    copy

    $ sbx --cloud create --name ci-task --cpus 4 --memory 8g --ttl 2h --on-timeout delete claude
    sbx --cloud exec ci-task make test
    sbx --cloud rm --force ci-task

    Expose a web service running inside a cloud sandbox to get a public HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. URL for sharing or webhook testing.
    copy

    $ sbx --cloud ports cloud-project --publish 8080/tcp

    Create a persistent volume for dependency caching and mount it into a new cloud sandbox so repeated runs skip reinstalling packages.
    copy

    $ sbx --cloud volume create dependency-cache
    sbx --cloud create --name cloud-project --volume dependency-cache:/workspace/cache claude
    sbx --cloud exec cloud-project sudo chown agent:agent /workspace/cache

    • Adds --cloud flag to sbx commands to create and manage sandboxes on Docker-managed infrastructure using cloud IDs, names, and lifecycle controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx --cloud run with --name, --new, --detached, --cpus, --memory, --platform, --ttl, --on-timeout, --env, and --allow-network flags to control cloud sandbox creation and launch behavior.
    • Adds sbx --cloud create to provision a cloud sandbox without opening an agent session, printing the cloud sandbox ID for later use.
    • Adds sbx --cloud attach <sandbox-name> to reconnect to an existing cloud sandbox agent session by name or sbx_-prefixed ID.
    • Adds sbx --cloud exec to run commands inside a running cloud sandbox.

    +13 more show less

    • Adds sbx --cloud setup ssh and SSH connectivity via ssh <sandbox-id>@sbx_cloud to access cloud sandboxes with a standard SSH client.
    • Adds sbx --cloud cp to copy files or directories between the local machine and a cloud sandbox using absolute sandbox paths.
    • Adds sbx --cloud ports <sandbox> --publish to expose a TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. service port and receive a public HTTPS URL, with --unpublish to remove the exposure.
    • Adds sbx --cloud ttl and sbx --cloud ttl +<duration> to inspect and extend a cloud sandbox expiration (capped at 24 hours from creation), with --ttl and --on-timeout (values: stop, restart, delete) accepted at creation.
    • Adds sbx --cloud stop and sbx --cloud rm (with --force) to stop or permanently remove cloud sandboxes.
    • Adds sbx --cloud volume create and --volume <name>:<path> at sandbox creation for experimental persistent volumes that snapshot on sandbox exit.
    • Adds sbx --cloud template save and --template / --image-ref flags to capture a running cloud sandbox as a reusable cloud template and launch new sandboxes from it.
    • Adds sbx --cloud mcp load <server-name> --sandbox <sandbox> to connect a Docker Agentic Platform MCP server into a running cloud sandbox.
    • Adds sbx --cloud mcp ls (account-wide) and sbx --cloud mcp ls <sandbox> to list MCP servers reported by cloud sandbox gateways.
    • Adds sbx --cloud ls to list cloud sandboxes separately from local sandboxes.
    • Adds sbx --cloud diagnose to check CLI health, Docker sign-in, cloud API connectivity, and account access without requiring a local sandbox daemon.
    • Adds --detach-keys to sbx --cloud run and sbx --cloud attach to customize the detach key sequence (default detach: Ctrl+\).
    • Cloud sandboxes default to 2 CPUs and 4 GiB memory, with named T-shirt sizes (micro through xl) selectable via --cpus and --memory; supported platforms are linux/amd64 and linux/arm64.

    18 details in Everything

22. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes: Adds sbx --cloud flag to run sandboxes against Docker-managed cloud resources instead of local host resources, exposing sandbox ports via public HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. URLs instead of host port bindings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Migrate a local sandbox to the cloud backend for a workflow that needs cloud compute; confirm or force through the prompt when running in CI with no terminal.
    copy

    $ sbx move <sandbox-name> --cloud --force

    Copy files out of a cloud sandbox that has no host mount, before removing the source after a move.
    copy

    $ sbx cp <sandbox-name>:/workspace/output ./local-output

    • Adds separate sbx --cloud secret store (sbx --cloud backend) distinct from the local sbx secret store, requiring independent credential configuration for cloud sandboxes.
    • Supports sbx --cloud env with environment files for cloud sandboxes, accepting a subset of local configuration fields: agents, environment variables, resource limits, and credentials.
    • Adds sbx cp for transferring files separately when workspace mounts or cloud volumes are not copied during a move.
    • Enforces rejection of local-only flags when used with --cloud rather than silently ignoring them.
    • Cloud sandboxes support linux/amd64 and linux/arm64 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. architectures, subject to account availability, with platform compatibility checked before transfer.

    +3 more show less

    • Cloud sandboxes use sandbox lifetime managed by time-to-livetime-to-liveTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and timeout action, rather than persisting until explicit removal.
    • Cloud network policy supports account and sandbox network rules but rejects local governance profiles and the --protocol option; L7 filtering (HTTP method and path restrictions) is not supported in cloud sandboxes.
    • Resources (sandboxes, templates, secrets, volumes, network policy) are fully separated between backends: sbx ls and sbx --cloud ls show independent lists.
    • Adds separate sbx --cloud secret store (sbx --cloud backend) distinct from the local sbx secret store, requiring independent credential configuration for cloud sandboxes.
    • Supports sbx --cloud env with environment files for cloud sandboxes, accepting a subset of local configuration fields: agents, environment variables, resource limits, and credentials.
    • Adds sbx cp for transferring files separately when workspace mounts or cloud volumes are not copied during a move.
    • Cloud sandboxes support linux/amd64 and linux/arm64 CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. architectures, subject to account availability, with platform compatibility checked before transfer.
    • Cloud sandboxes use sandbox lifetime managed by time-to-livetime-to-liveTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. and timeout action, rather than persisting until explicit removal.

    +2 more show less

    • Cloud network policy supports account and sandbox network rules but rejects local governance profiles and the --protocol option; L7 filtering (HTTP method and path restrictions) is not supported in cloud sandboxes.
    • Resources (sandboxes, templates, secrets, volumes, network policy) are fully separated between backends: sbx ls and sbx --cloud ls show independent lists.

    1 more in Everything

23. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes: Adds --cloud global flag to the sbx CLI (v0.45.0+) to route supported commands to the Cloud Sandboxes API instead of local execution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Spin up a cloud sandbox with selective network access and run a Claude agent against a cloned repo — without tying up local compute.
    copy

    $ sbx --cloud create --name cloud-project --allow-network github.com:443 claude
    sbx --cloud exec cloud-project git clone https://github.com/docker/welcome-to-docker.git /home/agent/workspace/project
    sbx --cloud attach cloud-project

    Store a cloud-scoped Anthropic API key before launching an agent — local credentials are not shared with cloud sandboxes.
    copy

    $ sbx --cloud secret set anthropic

    Retrieve output produced by a cloud agent and clean up the sandbox when done.
    copy

    $ sbx --cloud cp cloud-project:/home/agent/workspace/review.md ./review.md
    sbx --cloud rm cloud-project

    • Adds sbx login command to authenticate against a Docker Agentic Platform subscription from the CLI.
    • Adds sbx --cloud secret set subcommand to configure cloud-scoped credentials (e.g. Anthropic API keys) separately from local sandbox secrets.
    • Supports sbx --cloud create, sbx --cloud exec, sbx --cloud attach, and sbx --cloud rm for full cloud sandbox lifecycle management.
    • Cloud sandboxes run on Docker-managed infrastructure with cloud-managed secrets, network policy, ports, and lifecycle — no host virtualization required.
    • Cloud sandboxes expire after one hour by default, with configurable timeout/expiration action.

    5 details in Everything

24. docs update Sep 25, 2026 · issue 085

    Docker Sandboxes adds sbx template subcommands to save, list, remove, export, import, and load sandbox filesystem snapshots as reusable template images.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Snapshot a configured sandbox as a reusable template, then spin up a fresh sandbox from it — ideal for sharing a pre-tooled environment across a team.
    copy

    $ sbx template save my-sandbox my-template:v1
    sbx run -t my-template:v1 claude

    Export a template to a tar and load it on another machine that has no registry access, then launch a sandbox from it.
    copy

    $ # On the source machine
    sbx template save my-sandbox my-template:v1 --output my-template.tar
    
    # On the target machine
    sbx template load my-template.tar
    sbx run -t my-template:v1 claude

    Store credentials for a private GitHub Container Registry image before pulling it as a template, so the pull is authenticated rather than anonymous.
    copy

    $ gh auth token | sbx secret set --registry ghcr.io --password-stdin
    sbx run --template ghcr.io/my-org/my-template:v1 claude

    • Adds sbx template save <sandbox-name> <name:tag> to snapshot a sandbox's container filesystem as a reusable template image stored in the sandbox runtime's local image store.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx template save ... --output <file>.tar to export a saved template as a tar file for sharing or moving to another machine.
    • Adds sbx template load <file>.tar to import a tar file directly into the sandbox runtime's image store, bypassing any registry requirement.
    • Adds sbx template ls to list all saved template images.
    • Adds sbx template rm <name:tag> to delete a saved template image.

    +3 more show less

    • Adds -t / --template flag to sbx run to create a sandbox from a saved or registry-hosted template image (e.g., sbx run -t my-template:v1 claude or sbx run --template docker.io/my-org/my-template:v1 claude).
    • Adds sbx secret set --registry <registry> --password-stdin to store pull credentials for non-Docker Hub registries (GitHub Container Registry, ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., ACR, self-hosted Nexus, etc.) before pulling private template images.
    • Template caching persists downloaded layers across sandbox creation and deletion; cached images are cleared when sbx reset is run.

    8 details in Everything

25. announced Sep 24, 2026 · issue 085

    Docker Sandbox Kit Specification v3 introduces OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.-native Kit format for declaring agent authority as versioned, reviewable config⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a sandboxed agent with the GitHub CLI mixin to give it scoped GitHub access defined by the Kit's network-policy and credential declarations.
    copy

    $ cd examples
    sbx run ./hello --kit ./gh

    Author a mixin Kit that allows most GitHub API methods but explicitly denies DELETE on /repos/**, keeping a token that can open PRs from deleting repositories.
    yaml copy

    capabilities:
      - type: com.docker.sandbox/network-policy@2
        config:
          runtime:
            allow:
              - github.com
              - hosts: [api.github.com]
                methods: [GET, HEAD, POST, PATCH, PUT, DELETE]
            deny:
              - hosts: [api.github.com]
                methods: [DELETE]
                paths: [/repos/**]
      - type: com.docker.sandbox/credential@1
        optional: true
        config:
          service: github
          phase: runtime
          apiKey:
            name: GH_TOKEN
          proxyManaged: true
          inject:
            - {domain: api.github.com, header: Authorization, format: 'Bearer %s'}

    • Introduces the Docker Sandbox Kit Specification v3, open source under Apache 2.0 at docker/sandbox-kit-spec, defining a portable OCI image format for declaring exactly what authority a sandbox agent may exercise.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Stores all Kit declarations in a single OCI manifest annotation (vnd.docker.sandbox.kit.descriptor), so Kits build with docker buildx build, pull with docker pull, and are pinnable by digest.
    • Supports two Kit kinds: a workload Kit (supplies the root filesystem) and a mixin Kit (an overlay adding a CLI, network rule, or credential binding), composed at launch with one workload and any number of mixins.
    • Defines versioned capability types — including com.docker.sandbox/network-policy@2 and com.docker.sandbox/credential@1 — each with a normative page describing what a conforming runtime must enforce.
    • Network-policy capabilities support explicit allow and deny rules scoped to hosts, methods, and paths, with deny taking precedence, so a mixin can permit most of an API while blocking specific destructive operations (e.g. DELETE /repos/**).

    +4 more show less

    • Credential capabilities support proxyManaged: true mode, where the runtime injects the real token into requests to named domains and exposes only a sentinel inside the sandbox.
    • A kind: set descriptor names a collection of Kits and runs coherence checks at build time, merging them into one ordinary Kit so incoherence is caught at the author's build, not at a user's launch.
    • Adds authority-diff gating: every descriptor reduces to a normalized grant set; a runtime may auto-apply updates that stay within the recorded set, but any widening — including removing a deny rule — stops and requires explicit approval.
    • Ships two conformance suites: one that judges whether an artifact is a conforming Kit, and one that verifies whether a runtime implements the specification's normative requirements.

    9 details in Everything

26. announced Sep 24, 2026 · issue 085

    Docker Sandboxes adds Cloud Sandboxes: managed microVM compute in the cloud with sbx --cloud run and sbx move --to cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Launch a Claude Code agent in the cloud before leaving for the day so it keeps running overnight without your laptop.
    copy

    $ sbx --cloud run claude

    Hand off a long-running refactor you started locally to cloud compute so you can close your laptop without interrupting the agent.
    copy

    $ sbx move my-project --to cloud

    • Adds sbx --cloud run <kit> to launch a sandbox on Docker-managed cloud compute, with size options from Micro (1 vCPU / 2 GiB, $0.07/hr) to XL (16 vCPU / 32 GiB, $1.12/hr) and sessions up to 24 hours.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Kits: pre-configured, pre-built sandbox images for leading coding agents (Claude Code, Codex, Copilot, Antigravity, Open Code, Hermes), launchable with a single sbx --cloud run <kit> command.
    • Adds a centralized MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway so agents running in cloud, locally, or in other clients (e.g. ChatGPT desktop) can share a single set of connected MCP servers (Jira, Linear, Grafana, incident.io, or any streamable HTTP endpoint).
    • Adds a Cloud Sandboxes secrets proxy that injects stored keys or tokens per-request so agents never hold the actual secret value.
    • Adds network policies that define which endpoints agents can reach, configurable once and applied across all cloud sandboxes.

    +2 more show less

    • Adds a web console for spinning up and managing Cloud Sandboxes without the CLI, including Kit selection and a Run button.
    • Requires sbx version 0.45.1 or later for cloud sandbox support.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Local and cloud sandboxes maintain separate secrets, templates, and network policies — existing local workflows must be reconfigured before moving to cloud.
27. announced Sep 24, 2026 · issue 013

    Docker Sandboxes adds Cloud Sandboxes: managed microVM compute in the cloud with sbx --cloud run and sbx move --to cloud.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    ⤢ ⤢ ⤢ ⤢
    └──▷ TRY IT
    Launch a Claude Code agent in the cloud before leaving for the day so it keeps running overnight without your laptop.
    copy

    $ sbx --cloud run claude

    Hand off a long-running refactor you started locally to cloud compute so you can close your laptop without interrupting the agent.
    copy

    $ sbx move my-project --to cloud

    • Adds sbx --cloud run <kit> to launch a sandbox on Docker-managed cloud compute, with size options from Micro (1 vCPU / 2 GiB, $0.07/hr) to XL (16 vCPU / 32 GiB, $1.12/hr) and sessions up to 24 hours.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces Kits: pre-configured, pre-built sandbox images for leading coding agents (Claude Code, Codex, Copilot, Antigravity, Open Code, Hermes), launchable with a single sbx --cloud run <kit> command.
    • Adds a centralized MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway so agents running in cloud, locally, or in other clients (e.g. ChatGPT desktop) can share a single set of connected MCP servers (Jira, Linear, Grafana, incident.io, or any streamable HTTP endpoint).
    • Adds a Cloud Sandboxes secrets proxy that injects stored keys or tokens per-request so agents never hold the actual secret value.
    • Adds network policies that define which endpoints agents can reach, configurable once and applied across all cloud sandboxes.

    +2 more show less

    • Adds a web console for spinning up and managing Cloud Sandboxes without the CLI, including Kit selection and a Run button.
    • Requires sbx version 0.45.1 or later for cloud sandbox support.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Local and cloud sandboxes maintain separate secrets, templates, and network policies — existing local workflows must be reconfigured before moving to cloud.
28. announced Sep 24, 2026 · issue 013

    Docker Sandbox Kit Specification v3 introduces OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.-native Kit format for declaring agent authority as versioned, reviewable config⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run a sandboxed agent with the GitHub CLI mixin to give it scoped GitHub access defined by the Kit's network-policy and credential declarations.
    copy

    $ cd examples
    sbx run ./hello --kit ./gh

    Author a mixin Kit that allows most GitHub API methods but explicitly denies DELETE on /repos/**, keeping a token that can open PRs from deleting repositories.
    yaml copy

    capabilities:
      - type: com.docker.sandbox/network-policy@2
        config:
          runtime:
            allow:
              - github.com
              - hosts: [api.github.com]
                methods: [GET, HEAD, POST, PATCH, PUT, DELETE]
            deny:
              - hosts: [api.github.com]
                methods: [DELETE]
                paths: [/repos/**]
      - type: com.docker.sandbox/credential@1
        optional: true
        config:
          service: github
          phase: runtime
          apiKey:
            name: GH_TOKEN
          proxyManaged: true
          inject:
            - {domain: api.github.com, header: Authorization, format: 'Bearer %s'}

    • Introduces the Docker Sandbox Kit Specification v3, open source under Apache 2.0 at docker/sandbox-kit-spec, defining a portable OCI image format for declaring exactly what authority a sandbox agent may exercise.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Stores all Kit declarations in a single OCI manifest annotation (vnd.docker.sandbox.kit.descriptor), so Kits build with docker buildx build, pull with docker pull, and are pinnable by digest.
    • Supports two Kit kinds: a workload Kit (supplies the root filesystem) and a mixin Kit (an overlay adding a CLI, network rule, or credential binding), composed at launch with one workload and any number of mixins.
    • Defines versioned capability types — including com.docker.sandbox/network-policy@2 and com.docker.sandbox/credential@1 — each with a normative page describing what a conforming runtime must enforce.
    • Network-policy capabilities support explicit allow and deny rules scoped to hosts, methods, and paths, with deny taking precedence, so a mixin can permit most of an API while blocking specific destructive operations (e.g. DELETE /repos/**).

    +4 more show less

    • Credential capabilities support proxyManaged: true mode, where the runtime injects the real token into requests to named domains and exposes only a sentinel inside the sandbox.
    • A kind: set descriptor names a collection of Kits and runs coherence checks at build time, merging them into one ordinary Kit so incoherence is caught at the author's build, not at a user's launch.
    • Adds authority-diff gating: every descriptor reduces to a normalized grant set; a runtime may auto-apply updates that stay within the recorded set, but any widening — including removing a deny rule — stops and requires explicit approval.
    • Ships two conformance suites: one that judges whether an artifact is a conforming Kit, and one that verifies whether a runtime implements the specification's normative requirements.

    9 details in Everything

29. docs update Sep 24, 2026 · issue 084

    Docker Sandboxes gains sbx settings for configuring clipboard access, kit sources, SSH agent forwarding, registry mirrors, and more via CLI or env vars.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Enforce that all kits come from your org's GitHub and Docker Hub only, then require valid signatures — lock down kit provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. in a shared environment.
    copy

    $ sbx settings set kit.allowedSources '["docker.io/","github.com/myorg/"]'
    sbx settings set kit.requireSignature true

    Pin all sandboxes to a password manager's SSH agent socket so Git auth and commit signing always use the same agent regardless of which shell starts the sandbox.
    copy

    $ sbx settings set ssh.agentSocketPath "$SSH_AUTH_SOCK"
    sbx daemon restart

    Route Docker Hub image pulls through a corporate registry mirror and increase the default sandbox Docker volume to 20 GB for image-heavy workloads.
    copy

    $ sbx settings set platform.images.registryMirror registry.example.com/docker-remote
    sbx settings set sandbox.disk.dockerVolume 20g

    • Adds sbx settings list to view all settings with their effective value, type, source, and description; use --no-trunc for full text or --json for complete records including defaults and environment variable names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx settings get <key> to inspect a single setting's effective value, or pass --json to include source and default.
    • Adds sbx settings set <key> <value> to write a persistent override for any setting, including JSON values like kit.allowedSources.
    • Adds sbx settings unset <key> to remove a stored override and fall back to the environment variable or built-in default.
    • Adds clipboard.imagePaste boolean setting (default false, env DOCKER_SANDBOXES_CLIPBOARD_IMAGE_PASTE) to allow sandboxed agents to read host clipboard images via Ctrl+V.

    +12 more show less

    • Adds claude.remoteControl boolean setting (default false, env DOCKER_SANDBOXES_CLAUDE_REMOTE_CONTROL) to permit Claude Code's /remote-control command to authenticate with its own session token instead of the proxied host credential.
    • Adds env.rememberHostCommands boolean setting (default false) to persist approval of trusted environment file host commands across invocations until those commands change.
    • Adds ssh.agentForwardingEnabled boolean setting (default true, requires sbx daemon restart) to control whether sandboxes can request signatures from the host SSH agent.
    • Adds ssh.agentSocketPath string setting (default empty, requires sbx daemon restart) to pin all sandboxes to a specific host SSH agent socket path.
    • Adds platform.images.registryMirror string setting (default empty) to route Docker Hub pulls through an organization registry mirror.
    • Adds platform.images.useDHI boolean setting (default false, env DOCKER_SANDBOXES_USE_DHI) to use Docker Hardened Image variants for default agent templates.
    • Adds sandbox.disk.dockerVolume string setting (default 10g, also overridable per-invocation via DOCKER_SANDBOXES_DOCKER_SIZE) to set the default Docker volume size for new sandboxes.
    • Adds kit.allowedSources JSON array setting (default ["docker.io/"], env DOCKER_SANDBOXES_KIT_ALLOWED_SOURCES) to control which remote registries and Git repositories kits may be installed from.
    • Adds kit.allowLocalKits boolean setting (default true, env DOCKER_SANDBOXES_KIT_ALLOW_LOCAL) to control whether kits may be loaded from local directories or ZIP files.
    • Adds kit.allowExtractedAgents boolean setting (default true, env DOCKER_SANDBOXES_KIT_ALLOW_EXTRACTED_AGENTS) to control whether pinned built-in agent kits are exempted from kit.allowedSources and kit.requireSignature checks.
    • Adds kit.requireSignature boolean setting (default false, env DOCKER_SANDBOXES_KIT_REQUIRE_SIGNATURE) to reject unsigned kits or kits whose signatures do not match kit.trustedSigners.
    • Adds kit.trustedSigners JSON array setting (env DOCKER_SANDBOXES_KIT_TRUSTED_SIGNERS) to specify keyless signers or public keys whose kit signatures are trusted.

    17 details in Everything

30. docs update Sep 23, 2026 · issue 083

    Docker Sandboxes gains --model and --provider flags plus llmman to run local, Ollama, or hosted AI models inside sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run the Claude agent with a local GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. model — useful when you want fully offline inference with no provider charges.
    copy

    $ sbx settings set platform.allowExperimentalFeatures true
    sbx settings set feature.model true
    sbx run --model gemma4 claude

    Route overflow requests to OpenAI when local context is exhausted, keeping small requests private while handling large ones in the cloud.
    copy

    $ export OPENAI_API_KEY=sk-...
    sbx run --model gemma4 --overflow-provider openai --overflow-model gpt-5-nano claude

    Connect an internal GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. inference server as a named custom provider so any agent can use it with --provider company.
    copy

    $ sbx settings set model.providers '{"company":{"url":"https://inference.example.com/v1","wire":"openai","apiKeyEnv":"COMPANY_API_KEY"}}'

    • Adds sbx run --model <model> flag to select the model that answers an agent's requests, supporting local GGUF models, Ollama, and hosted providers like openai or anthropic.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx run --provider <provider> flag to route model requests to llmman (default), an existing Ollama install at localhost:11434, a hosted provider, or a custom endpoint defined in model.providers.
    • Adds sbx run --overflow-provider <provider> and --overflow-model <model> flags to pair a local model with a fallback hosted provider for requests that exceed local context capacity.
    • Adds sbx run --name <sandbox_name> support for changing the model of an existing sandbox, recreating the container while preserving the workspace and kit-owned volumes.
    • Adds model.providers setting (JSON object keyed by provider ID) to sbx settings for connecting custom OpenAI- or Anthropic-compatible inference endpoints, with fields url, wire (openai or anthropic), apiKeyEnv, and name.

    +2 more show less

    • Enables model selection via sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.model true.
    • Bundles llmman, a model management service installed alongside sbx that serves local models, manages a shared model store, and forwards requests to hosted providers or custom endpoints.

    7 details in Everything

31. docs update Sep 23, 2026 · issue 083

    Docker Sandboxes adds sandbox-scoped secrets with precedence over global secrets and live hot-reload in existing sandboxes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Remove a sandbox-scoped secret to fall back to the global secret for that service without restarting the sandbox.
    copy

    $ sbx secret rm github --sandbox my-sandbox

    • Adds sandbox-scoped secrets that take precedence over global secrets, configurable with sbx secret rm <service> --sandbox <sandbox-name>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Secret changes (add, update, remove) take effect in existing local sandboxes without a restart.
    • Adds sandbox-scoped secrets that take precedence over global secrets, configurable with sbx secret rm <service> --sandbox <sandbox-name>.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

32. docs update Sep 23, 2026 · issue 083

    Docker Sandboxes adds GitHub Copilot provider support and --model flag for local/hosted model selection in OpenCode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Run an OpenCode sandbox with a specific local or hosted model instead of the default.
    copy

    $ sbx run --model <model-name>

33. v0.45.0 Sep 21, 2026 · issue 081

    Docker Sandboxes v0.45.0 ships v3 OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. kits with workload/mixin composition, new model provider settings, and a raft of new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.45.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.45.0

    └──▷ TRY IT
    Route agent runs through a custom Anthropic-compatible endpoint instead of the built-in provider.
    copy

    $ sbx run --model my-anthropic-proxy/claude-3-5-sonnet 'summarize the repo'

    Allow outbound UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. (e.g. for a DNS-over-UDP workflow) in a sandbox network policy instead of the TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.-only default.
    copy

    $ sbx policy allow network --protocol udp 8.8.8.8:53

    Work around a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server that stalls long-lived HTTP/2 streams by forcing HTTP/1.1.
    copy

    $ sbx mcp add --disable-http2 my-mcp-server https://mcp.example.com/sse

    • Adds sbx run --model support for any OpenAI- or Anthropic-compatible endpoint configured via the new model.providers setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx mcp add --disable-http2 to disable HTTP/2 for a remote MCP transport, working around servers whose HTTP/2 handling stalls long-lived streams.
    • Adds --quiet (-q) flag to MCP server, secret, skill, template, volume, and policy-profile list commands for name-only output.
    • Adds --protocol flag to local network allow rules so UDP can be selected explicitly alongside the default TCP coverage.
    • Adds --created-via filter to sbx policy ls, which also now shows how each rule was created.

    +16 more show less

    • Adds --force (and --yes/-y for sbx kit builder history rm) flags for non-interactive confirmation of destructive commands.
    • Adds created_at, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. limits, and memory limits to sbx ls --json and sbx inspect --json output.
    • Adds sbx kit validate rejection of malformed API-key declarations, including invalid names, missing injection domains, invalid format placeholders, and Basic-auth usernames containing a colon, plus warnings for no-op or out-of-allowlist declarations.
    • Introduces v3 kits: OCI-based packages with separate workload and mixin roles that combine base environments, tools, configuration, credentials, network access, and agent instructions.
    • Introduces kit sets, letting authors combine a workload and mixins, pin component versions, and publish the result as a single OCI reference with its own capabilities, lifecycle hooks, instructions, and arguments.
    • V3 kits can scope network access by HTTP method and path, declare install-phase network access and credential use, and specify where an agent reads shared skills.
    • Multiple OAuth-backed agents can now be composed in the same sandbox with credentials scoped to the individual kits that request them.
    • Experimental outbound UDP now follows sandbox network policy.
    • Adding, updating, or removing global service secrets now updates existing local sandboxes without a restart.
    • OAuth refreshes are coordinated across sandboxes that share credentials, preventing simultaneous refreshes from forcing another sign-in.
    • Reverse-DNS lookups are now restricted to destination IPs already authorized by policy, closing a previous policy bypass.
    • DNS resolution is blocked when no network rule permits it.
    • sbx policy allow network, sbx policy deny network, --allow-network, and --deny-network now reject malformed patterns before saving them.
    • sbx run opencode --model now exposes the model's supported thinking levels as OpenCode variants, selectable with Ctrl+T.
    • The OpenCode kit now configures GitHub Copilot from the account's stored GitHub credential, enabling Copilot models without a separate device login.
    • macOS distributions now ship as a single signed Sbx.app bundle, with Homebrew and tarball PATH installs working via a symlink into the bundle.
    • Adds sbx run --model support for any OpenAI- or Anthropic-compatible endpoint configured via the new model.providers setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces v3 kits: OCI-based packages with separate workload and mixin roles that combine base environments, tools, configuration, credentials, network access, and agent instructions.
    • Introduces kit sets, letting authors combine a workload and mixins, pin component versions, and publish the result as a single OCI reference with its own capabilities, lifecycle hooks, instructions, and arguments.
    • V3 kits can scope network access by HTTP method and path, declare install-phase network access and credential use, and specify where an agent reads shared skills.
    • Multiple OAuth-backed agents can now be composed in the same sandbox with credentials scoped to the individual kits that request them.

    +2 more show less

    • Experimental outbound UDP now follows sandbox network policy.
    • OAuth refreshes are coordinated across sandboxes that share credentials, preventing simultaneous refreshes from forcing another sign-in.

    14 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !sbx mcp catalog has been removed; register a remote MCP server with sbx mcp add and then authorize it with sbx mcp auth instead.
    • !sbx secret rm now returns an error on stderr when the requested secret does not exist (previously silent).
    • !sbx mcp rm now returns an error when the requested MCP server is not registered (previously silent).
    • !V3 workloads and mixins must be used together; they cannot be combined with v1 or v2 kits.
    • !Commands that remove resources now prompt for confirmation and return a non-zero exit code when the prompt is declined; use --force or --yes/-y in non-interactive workflows.
    • !sbx exec -d / --detach now fails immediately for unsupported detached execution instead of silently running in the foreground.
34. v0.45.0 Sep 21, 2026 · issue 013

    Docker Sandboxes v0.45.0 ships v3 OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. kits with workload/mixin composition, new model provider settings, and a raft of new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.45.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.45.0

    └──▷ TRY IT
    Route agent runs through a custom Anthropic-compatible endpoint instead of the built-in provider.
    copy

    $ sbx run --model my-anthropic-proxy/claude-3-5-sonnet 'summarize the repo'

    Allow outbound UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. (e.g. for a DNS-over-UDP workflow) in a sandbox network policy instead of the TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it.-only default.
    copy

    $ sbx policy allow network --protocol udp 8.8.8.8:53

    Work around a remote MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server that stalls long-lived HTTP/2 streams by forcing HTTP/1.1.
    copy

    $ sbx mcp add --disable-http2 my-mcp-server https://mcp.example.com/sse

    • Adds sbx run --model support for any OpenAI- or Anthropic-compatible endpoint configured via the new model.providers setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds sbx mcp add --disable-http2 to disable HTTP/2 for a remote MCP transport, working around servers whose HTTP/2 handling stalls long-lived streams.
    • Adds --quiet (-q) flag to MCP server, secret, skill, template, volume, and policy-profile list commands for name-only output.
    • Adds --protocol flag to local network allow rules so UDP can be selected explicitly alongside the default TCP coverage.
    • Adds --created-via filter to sbx policy ls, which also now shows how each rule was created.

    +16 more show less

    • Adds --force (and --yes/-y for sbx kit builder history rm) flags for non-interactive confirmation of destructive commands.
    • Adds created_at, CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. limits, and memory limits to sbx ls --json and sbx inspect --json output.
    • Adds sbx kit validate rejection of malformed API-key declarations, including invalid names, missing injection domains, invalid format placeholders, and Basic-auth usernames containing a colon, plus warnings for no-op or out-of-allowlist declarations.
    • Introduces v3 kits: OCI-based packages with separate workload and mixin roles that combine base environments, tools, configuration, credentials, network access, and agent instructions.
    • Introduces kit sets, letting authors combine a workload and mixins, pin component versions, and publish the result as a single OCI reference with its own capabilities, lifecycle hooks, instructions, and arguments.
    • V3 kits can scope network access by HTTP method and path, declare install-phase network access and credential use, and specify where an agent reads shared skills.
    • Multiple OAuth-backed agents can now be composed in the same sandbox with credentials scoped to the individual kits that request them.
    • Experimental outbound UDP now follows sandbox network policy.
    • Adding, updating, or removing global service secrets now updates existing local sandboxes without a restart.
    • OAuth refreshes are coordinated across sandboxes that share credentials, preventing simultaneous refreshes from forcing another sign-in.
    • Reverse-DNS lookups are now restricted to destination IPs already authorized by policy, closing a previous policy bypass.
    • DNS resolution is blocked when no network rule permits it.
    • sbx policy allow network, sbx policy deny network, --allow-network, and --deny-network now reject malformed patterns before saving them.
    • sbx run opencode --model now exposes the model's supported thinking levels as OpenCode variants, selectable with Ctrl+T.
    • The OpenCode kit now configures GitHub Copilot from the account's stored GitHub credential, enabling Copilot models without a separate device login.
    • macOS distributions now ship as a single signed Sbx.app bundle, with Homebrew and tarball PATH installs working via a symlink into the bundle.
    • Adds sbx run --model support for any OpenAI- or Anthropic-compatible endpoint configured via the new model.providers setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Introduces v3 kits: OCI-based packages with separate workload and mixin roles that combine base environments, tools, configuration, credentials, network access, and agent instructions.
    • Introduces kit sets, letting authors combine a workload and mixins, pin component versions, and publish the result as a single OCI reference with its own capabilities, lifecycle hooks, instructions, and arguments.
    • V3 kits can scope network access by HTTP method and path, declare install-phase network access and credential use, and specify where an agent reads shared skills.
    • Multiple OAuth-backed agents can now be composed in the same sandbox with credentials scoped to the individual kits that request them.

    +2 more show less

    • Experimental outbound UDP now follows sandbox network policy.
    • OAuth refreshes are coordinated across sandboxes that share credentials, preventing simultaneous refreshes from forcing another sign-in.

    14 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !sbx mcp catalog has been removed; register a remote MCP server with sbx mcp add and then authorize it with sbx mcp auth instead.
    • !sbx secret rm now returns an error on stderr when the requested secret does not exist (previously silent).
    • !sbx mcp rm now returns an error when the requested MCP server is not registered (previously silent).
    • !V3 workloads and mixins must be used together; they cannot be combined with v1 or v2 kits.
    • !Commands that remove resources now prompt for confirmation and return a non-zero exit code when the prompt is declined; use --force or --yes/-y in non-interactive workflows.
    • !sbx exec -d / --detach now fails immediately for unsupported detached execution instead of silently running in the foreground.
35. docs update Sep 16, 2026 · issue 076

    Docker Sandboxes MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway gains custom request headers with secret-placeholder substitution for remote MCP endpoints⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Register a remote MCP server that requires API-key authentication without hard-coding the key in the registration.
    copy

    $ sbx secret set mcp:acme:api-key
    sbx mcp add acme --url https://mcp.acme.com/mcp \
      --header 'Authorization: Bearer ${api-key}' \
      --header 'Accept: application/json, text/event-stream'
    sbx run claude --name acme-demo --static-mcp acme

    Verify which header templates are registered for a server and confirm their secrets are present before launching a sandbox.
    copy

    $ sbx mcp inspect acme

    Rotate a header secret in place so the next sandbox start picks up the new value.
    copy

    $ sbx secret set mcp:acme:api-key
    # then restart the sandbox or sandboxd to apply the change

    • Adds --header 'Name: value' flag to sbx mcp add for sending custom HTTP headers (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Authorization, Accept) to remote MCP endpoints, repeatable per header.
    • Adds secret-placeholder syntax ${placeholder} in header values, resolved at sandbox connect time from the host credential store via sbx secret set mcp:<server>:<placeholder>.
    • Adds sbx secret rm mcp:<server>:<placeholder> to remove header secrets after a server registration is removed.
    • Adds sbx mcp inspect <server> to display registered header templates and whether their secrets are set, without revealing resolved values.
    • Stores MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. client secrets under mcp:<server>:client_secret (colon-separated), replacing the legacy mcp:<server>.client_secret dot-separated naming.
    • Adds --header 'Name: value' flag to sbx mcp add for sending custom HTTP headers (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Authorization, Accept) to remote MCP endpoints, repeatable per header.
    • Adds secret-placeholder syntax ${placeholder} in header values, resolved at sandbox connect time from the host credential store via sbx secret set mcp:<server>:<placeholder>.
    • Adds sbx secret rm mcp:<server>:<placeholder> to remove header secrets after a server registration is removed.
    • Adds sbx mcp inspect <server> to display registered header templates and whether their secrets are set, without revealing resolved values.

    1 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !MCP OAuth client secrets previously stored under the dot-separated name mcp:<server>.client_secret must be re-set using the colon-separated name mcp:<server>:client_secret.
36. docs update Sep 16, 2026 · issue 076

    Docker Sandboxes environment files gain --name flag, ${{ env.fileDir }} reference, and skills access control field⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Override the sandbox name at runtime so the same environment file can spin up isolated sandboxes for different branches without editing the file.
    copy

    $ sbx env create --name feature-branch-test
    sbx env run --name feature-branch-test -- npm test
    sbx env rm --name feature-branch-test

    Use ${{ env.fileDir }} in a shared environment file to run a setup script stored next to the file, regardless of which project directory invokes it.
    /shared/environment.yaml copy

    lifecycle:
      post_create:
        - ${{ env.fileDir }}/scripts/setup.sh

    Grant the sandbox write access to the shared agent skills store when the agent needs to persist new skills across sessions.
    yaml copy

    skills: readwrite

    • Adds --name flag to all sbx env subcommands (sbx env create, sbx env run, sbx env rm) to override the sandbox name set in the environment file or auto-generated.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds ${{ env.fileDir }} variable expression in environment files, expanding to the absolute path of the directory containing the file where the reference is written — useful for locating scripts or assets stored alongside the environment file.
    • Adds skills field to environment files, controlling access to the shared agent skills store with values off, readonly, or readwrite; defaults to the daemon default (readonly unless overridden by the organization).
    • Supports ${{ env.projectDir }} variable expression in environment files to reference the absolute path of the project directory, resolving based on the path passed to the command.

    4 details in Everything

37. docs update Sep 16, 2026 · issue 076

    Docker Sandboxes adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway secret namespacing, scoped custom secrets, GitHub Packages npm credential injection, and --registry-auth-endpoint for self-hosted registries.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Trust a split-auth self-hosted GitLab registry so the sandbox proxy can exchange your stored PATPATA personal access token, a credential used by scripts and integrations instead of a user's password. Its permissions and expiry depend on the service issuing it. for a registry token at the advertised realm.
    copy

    $ sbx credentials add registry \
      --sandbox my-app \
      --registry registry.example.com \
      --username "$GITLAB_USER" \
      --password "$GITLAB_PAT" \
      --registry-auth-endpoint https://gitlab.example.com/jwt/auth

    Inject a dynamically refreshed GitHub token so sandboxed agents can install private npm packages from GitHub Packages without embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. the real token.
    copy

    $ sbx credentials add custom \
      --sandbox my-sandbox \
      --host npm.pkg.github.com \
      --env NODE_AUTH_TOKEN \
      --command 'gh auth token'

    Wire up the sandbox project so npm resolves private packages through the credential proxy using the injected placeholder.
    .npmrc copy

    @my-org:registry=https://npm.pkg.github.com
    //npm.pkg.github.com/:_authToken=${NODE_AUTH_TOKEN}

    • Adds --sandbox flag to sbx credential commands to scope a custom secret to a specific sandbox instead of the global default.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds --registry-auth-endpoint flag to trust a separate authentication host when a self-hosted registry (e.g. a self-hosted GitLab instance) uses a split Registry v2 Bearer auth flow.
    • Adds --host npm.pkg.github.com --env NODE_AUTH_TOKEN --command 'gh auth token' workflow to inject GitHub Packages credentials into sandboxes for installing private npm packages.
    • Reserves credential names starting with mcp: for the MCP gateway — these secrets stay on the host and are not injected into sandboxes, enabling the gateway to authenticate MCP server connections on behalf of sandboxed agents.
    • Supports configuring per-sandbox npm access to npm.pkg.github.com via .npmrc entries using ${NODE_AUTH_TOKEN} and a host-resolved placeholder, so the proxy substitutes the real token without exposing it inside the sandbox.

    5 details in Everything

38. docs update Sep 16, 2026 · issue 076

    Docker Sandboxes adds --skills flag and skills.defaultMode setting to control shared skill store access mode per sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Launch a sandbox completely isolated from the shared skill store to keep it outside the shared trust boundary.
    copy

    $ sbx run --skills=off claude

    Set the default skill store access mode to read-only for all future sandboxes so agents can consume skills but never mutate the shared store.
    copy

    $ sbx settings set skills.defaultMode readonly

    • Adds --skills flag to sbx run and sbx create to set the shared skill store mount mode — readonly, readwrite, or off — when creating a sandbox.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds skills.defaultMode setting (configurable via sbx settings set) to control the default shared skill store access mode for all future sandboxes, accepting readonly, readwrite, or off.

    2 details in Everything

39. docs update Sep 16, 2026 · issue 076

    Docker Sandboxes adds until filter for stopped-sandbox queries and auto-stop behavior for local sandboxes after sbx run completes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ TRY IT
    Restart a previously stopped local sandbox by name to resume work with its persisted files intact.
    copy

    $ sbx run --name my-sandbox

    • Adds until filter to sandbox queries, accepting a duration, RFC 3339 timestamp, or Unix timestamp to scope results by when a sandbox stopped (the existing since=<duration> filter remains supported).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

40. v0.43.0 Sep 15, 2026 · issue 076

    Docker Sandboxes v0.43.0 adds tri-state skills sharing, overflow model routing, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. custom headers, and richer sandbox lifecycle controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.43.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.43.0

    └──▷ TRY IT
    Run a local model but automatically fall back to a hosted provider when a request exceeds the local model's context limit.
    copy

    $ sbx run --model ollama/qwen2.5-coder --overflow-provider openai --overflow-model gpt-4o

    Connect an MCP server that requires a custom Authorization header sourced from the local secret vault, keeping the token out of shell history.
    copy

    $ sbx mcp add https://mcp.example.com --header 'Authorization: Bearer ${{ secret.mcp_token }}'

    Make a shared user-level environment automatically mount each project's own directory when launching a sandbox from any project folder.
    ~/.sbxenv.yaml copy

    workspace: ${{ env.projectDir }}

    • Adds --skills=off|readonly|readwrite flag to sbx create/sbx run for tri-state skills sharing (read-only by default); --no-share-skills still works as a deprecated alias for --skills=off.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds skills.defaultMode config key to set the desired default skills-sharing behaviour.
    • Adds --overflow-provider/--overflow-model flags to sbx run --model to pair a local model with a hosted fallback for oversized requests.
    • Adds --header flag to sbx mcp add to send custom request headers (with values substituted from the local secret vault) to remote MCP servers.
    • Environment files now support ${{ env.projectDir }} and ${{ env.fileDir }} variable references, and ~/.sbxenv.yaml can mount each project's own directory via workspace: ${{ env.projectDir }}.

    +13 more show less

    • Every sbx env subcommand now accepts --name to override the sandbox name.
    • sbx run --provider now accepts hosted models.dev providers, served through llmman.
    • Adds --skip-ssrf-check flag to MCP authorization for private OAuth discovery.
    • Adds a last-used timestamp field to sbx ls --json output.
    • Adds Docker-style until filtering to sbx prune.
    • sbx secret rm --sandbox now immediately revokes the removed credential from the sandbox proxy.
    • daemon inspect and inspect now show mount information.
    • Clone-mode sandboxes now support shallow Git repositories.
    • Windows clients can now connect to sandboxd through filesystem AF_UNIX sockets.
    • The minimum sandbox memory has been decreased to 512 MiB (suitable for shell use cases).
    • Kits can now be installed through registry mirrors configured with an explicit port.
    • sbx diagnose now checks whether mkfs.erofs is usable and warns if its default block size exceeds the sandbox kernel's page size.
    • Plain sbx version invocations now return embedded version information without full CLI startup.
    • Adds --skills=off|readonly|readwrite flag to sbx create/sbx run for tri-state skills sharing (read-only by default); --no-share-skills still works as a deprecated alias for --skills=off.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds skills.defaultMode config key to set the desired default skills-sharing behaviour.
    • Adds --overflow-provider/--overflow-model flags to sbx run --model to pair a local model with a hosted fallback for oversized requests.
    • Adds --header flag to sbx mcp add to send custom request headers (with values substituted from the local secret vault) to remote MCP servers.
    • Environment files now support ${{ env.projectDir }} and ${{ env.fileDir }} variable references, and ~/.sbxenv.yaml can mount each project's own directory via workspace: ${{ env.projectDir }}.

    +3 more show less

    • Adds --skip-ssrf-check flag to MCP authorization for private OAuth discovery.
    • Clone-mode sandboxes now support shallow Git repositories.
    • Windows clients can now connect to sandboxd through filesystem AF_UNIX sockets.

    10 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !shareSkills in sbxenv.yaml is replaced by skills; the new key accepts off|readonly|readwrite and the old key is no longer read.
    • !MCP OAuthMCP OAuthAn authentication layer for the Model Context Protocol that lets MCP clients obtain delegated access tokens so cyber tools can call MCP servers on a user's behalf without handling raw credentials. client secrets are renamed from mcp:<server>.client_secret to mcp:<server>:client_secret; any secret stored under the old name must be re-set with sbx secret set mcp:<server>:client_secret.
41. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes adds --kit-arg, --kit-args-file, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant./Git kit references in v0.42.0+

    └──▷ TRY IT
    Supply per-kit arguments from a file when creating a sandbox — useful for reproducible CI pipelines where secrets are kept out of shell history.
    copy

    $ sbx create ./my-agent/ . --kit ./my-mixin/ --kit-args-file ./kit.args --kit-arg my-mixin.channel=stable

    Launch a versioned sandbox kit directly from an OCI registry, targeting a specific tag.
    copy

    $ sbx run docker.io/sbx/droid-kit:latest

    • Adds --kit-arg name=value flag to sbx run / sbx create to supply typed inputs to schema v2 kits that declare an args: block, with ${{ kit.args.<name> }} interpolation in setup entries and static files.
    • Adds --kit-args-file <path> flag to load reusable name=value argument files (blank lines and # comments ignored); later files and explicit --kit-arg values override earlier ones.
    • Supports kit-specific argument targeting by prefixing --kit-arg values with the kit's name field and a period (e.g. --kit-arg my-mixin.version=2.0.0), taking precedence over unprefixed shared values.
    • Supports launching sandbox kits from OCI registries (e.g. sbx run docker.io/sbx/droid-kit:latest) and Git repositories (e.g. git+https://github.com/docker/sbx-kits-contrib.git#ref=v0.1.0&dir=amp).
    • Supports local sandbox kits and mixins passed as a directory or ZIP file path (must start with ./ or ../) to sbx run and sbx create.

    +3 more show less

    • Starting with version 0.42.0, sbx run <sandbox-kit-ref> PATH... and sbx create <sandbox-kit-ref> PATH... accept the kit reference as the first positional argument; the previous sbx run <name> --kit <ref> form is deprecated.
    • Passes the same --kit-arg and --kit-args-file flags to sbx kit validate and sbx kit inspect so validation runs with the same argument context as the live sandbox.
    • Adds mixin support via the --kit flag (repeatable) to attach independent capabilities to a sandbox alongside a primary kit.
    • Adds --kit-arg name=value flag to sbx run / sbx create to supply typed inputs to schema v2 kits that declare an args: block, with ${{ kit.args.<name> }} interpolation in setup entries and static files.
    • Adds --kit-args-file <path> flag to load reusable name=value argument files (blank lines and # comments ignored); later files and explicit --kit-arg values override earlier ones.
    • Supports launching sandbox kits from OCI registries (e.g. sbx run docker.io/sbx/droid-kit:latest) and Git repositories (e.g. git+https://github.com/docker/sbx-kits-contrib.git#ref=v0.1.0&dir=amp).
    • Supports local sandbox kits and mixins passed as a directory or ZIP file path (must start with ./ or ../) to sbx run and sbx create.
    • Adds mixin support via the --kit flag (repeatable) to attach independent capabilities to a sandbox alongside a primary kit.

    3 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !The sbx run <sandbox-kit-name> --kit <sandbox-kit-ref> form is deprecated as of version 0.42.0; use sbx run <sandbox-kit-ref> PATH... instead.
42. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes adds configurable sandbox volume size via environment variable and registry mirror support for Docker Hub pulls.

    • Supports setting sandbox volume size at creation time via an environment variable (minimum 512 MiB; default 10 GB sparse file); does not resize existing volumes.
    • Supports routing Docker Hub image pulls through an organization's registry mirror infrastructure.

    2 details in Everything

43. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes MCP GatewayMCP GatewayA server that sits between MCP clients and one or more Model Context Protocol backends, routing tool calls and aggregating context sources so a single endpoint exposes many AI-agent integrations at once. adds SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly. protection, --skip-ssrf-check, --skip-auth, --scope, --no-scope, and --json flags to MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration and auth flows.

    └──▷ TRY IT
    Register a trusted internal MCP server that resolves to a private IP without triggering the SSRF warning, so internal tooling can be wired up without noise.
    copy

    $ sbx mcp add myserver --url https://internal.corp/mcp --skip-ssrf-check

    Authorize against an OAuth-backed MCP server with a narrower scope than the recorded defaults — useful when a workflow only needs read access.
    copy

    $ sbx mcp auth serverx --scope read

    Pull machine-readable auth-status JSON for the Notion MCP server to feed into a CI check or audit script.
    copy

    $ sbx mcp auth status notion --json

    • Adds --skip-ssrf-check flag to sbx mcp add to suppress the SSRF warning and check when registering a trusted internal MCP server whose hostname resolves to a private, loopback, link-local, or cloud-metadata address.
    • Adds --scope flag to sbx mcp auth to override recorded default scopes for a single authorization, selecting from the scope resolution order: --scope argument, sbx mcp add --scope defaults, protected-resource required scopes, then no scope parameter.
    • Adds --no-scope flag to sbx mcp auth to suppress both recorded default scopes and the resource's required scopes for a single authorization (cannot be combined with --scope).
    • Adds --json flag to sbx mcp auth status for machine-readable output of granted, default, supported, duplicate, and unexpected scopes.

    4 details in Everything

44. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes gains registry mirror support via platform.images.registryMirror, routing Hub pulls through your org's registry infrastructure.

    └──▷ TRY IT
    Route all sandbox template, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. kit, and in-sandbox Docker Hub pulls through a corporate registry mirror.
    copy

    $ sbx settings set platform.images.registryMirror registry.example.com

    Mirror sandbox template and OCI kit pulls through a registry that stores Docker Hub content under a repository path prefix (in-sandbox Docker Engine will not use this mirror).
    copy

    $ sbx settings set platform.images.registryMirror registry.example.com/docker-remote

    Remove the registry mirror configuration so sandbox templates and OCI kits pull directly from Docker Hub.
    copy

    $ sbx settings unset platform.images.registryMirror

    • Adds platform.images.registryMirror setting (via sbx settings set) to route Docker Hub pulls for sandbox templates and OCI kits through an organization's registry mirror, with optional port and path-prefix support.
    • Propagates the mirror to Docker Engine inside the sandbox when the setting is a non-loopback host without a path prefix, enabling in-sandbox docker pull to use the same mirror.
    • Adds sbx settings unset platform.images.registryMirror to disable registry mirroring; an empty value also disables it.

    3 details in Everything

45. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes gains sbxenv.yaml environment files with parameterized args, lifecycle hooks, sbx env plan/create/run/destroy, and user-level defaults.

    └──▷ TRY IT
    Preview exactly what an environment file will change on the host before committing — useful before a first apply or after editing sbxenv.yaml.
    copy

    $ sbx env plan ./web-app-env/sbxenv.yaml

    Supply per-run argument values (e.g. target a beta release channel and a specific API endpoint) without editing the shared environment file.
    copy

    $ sbx env run --env-arg channel=beta --env-arg endpoint=https://api.example.com

    Parameterize a sandbox environment so the same file can target different release channels and API endpoints, with validation enforced at apply time.
    sbxenv.yaml copy

    args:
      channel:
        default: stable
        description: Release channel
        enum:
          - stable
          - beta
      endpoint:
        required: true
        description: API endpoint
        pattern: "https://.*"
    
    env:
      RELEASE_CHANNEL: ${{ env.args.channel }}
      API_ENDPOINT: ${{ env.args.endpoint }}
    
    lifecycle:
      initialize:
        - label: Prepare workspace
          cmd: test -d web-app || git clone https://github.com/example/web-app
          timeout: 5m

    • Adds sbx env plan [PATH...] subcommand to preview what applying an environment would change without modifying or approving anything.
    • Adds sbx env create --auto-approve to approve and apply an environment plan and create the sandbox in a single unattended invocation.
    • Adds sbx env run --env-arg NAME=VALUE and --env-args-file <file> flags to supply declared argument values to any sbx env command at runtime.
    • Adds --skip-host-commands flag to sbx env commands to bypass lifecycle command execution without removing approval.
    • Adds --force flag to the destroy command to approve the destroy plan and remove a sandbox even when it is in use.

    +8 more show less

    • Introduces sbxenv.yaml environment files that declaratively define sandboxes, including workspaces, kits, ports, secrets, bindings, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. registrations, and sandbox options.
    • Adds a top-level args block in sbxenv.yaml to declare parameterized inputs with default, required, enum, pattern, description, and channel fields, referenced as ${{ env.args.NAME }} anywhere a YAML value can appear.
    • Adds a lifecycle block in sbxenv.yaml with initialize, postCreate, and preRemove phases that run host commands with configurable cmd, label, workdir, and timeout fields.
    • Supports a user-level defaults file at ~/.sbxenv.yaml that is merged beneath the project sbxenv.yaml when no explicit path is passed.
    • Exposes lifecycle environment variables SBX_LIFECYCLE_PHASE, SBX_ENV_FILE, SBX_ENV_FILES, SBX_ENV_DIR, SBX_SANDBOX_NAME, SBX_AGENT, and SBX_WORKSPACE to host commands.
    • Adds shareSkills: false to sbxenv.yaml sandbox options to opt out of sharing the host agent skills store with the sandbox.
    • Adds display, gpu, and usb sandbox options in sbxenv.yaml for provisioning a display socket, passing through the host GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference., and selecting USB devices.
    • Adds env.rememberHostCommands setting to record approval of lifecycle and credential host commands across invocations until the command text changes.

    13 details in Everything

46. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes adds registry mirror support in sbxenv.yaml to route Hub pulls through your org's mirror.

47. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes gains sbx skills subcommands to install, list, update, and remove agent skills from a persistent shared store.

    └──▷ TRY IT
    Install specific skills from a GitHub repository into the shared store so every new sandbox picks them up automatically.
    copy

    $ sbx skills add anthropics/skills --skill frontend-design --skill pdf

    Refresh only the skills you actively use after upstream updates, without touching the rest of the store.
    copy

    $ sbx skills update frontend-design pdf

    Audit what is currently installed, then remove a skill no longer needed by running agents.
    copy

    $ sbx skills ls && sbx skills rm frontend-design

    • Adds sbx skills add to install all skills from a Git repository using owner/repository shorthand or HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate./SSH URLs.
    • Adds --skill flag on sbx skills add to install specific skills by name or comma-separated list (e.g. --skill frontend-design --skill pdf).
    • Adds sbx skills ls to list all skills in the persistent shared store.
    • Adds sbx skills update to refresh all or named skills (e.g. sbx skills update frontend-design pdf) installed via sbx skills add.
    • Adds sbx skills rm to remove one or more installed skills from the shared store.

    +1 more show less

    • Introduces a persistent shared skill store that survives sandbox deletion and is automatically shared with new sandboxes running a supported agent.

    6 details in Everything

48. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes adds native Devin agent support via sbx run devin, with managed credentials and project-level config.

    └──▷ TRY IT
    Run Devin against a specific project directory in an isolated sandbox — useful for CI or one-off agent tasks on a repo you don't want touching your host environment.
    copy

    $ sbx run devin ~/my-project

    Run Devin from within the project directory itself, letting the workspace default to the current directory.
    copy

    $ cd ~/my-project && sbx run devin

    • Adds sbx run devin subcommand to launch a Devin agent inside a Docker sandbox, with an optional workspace path argument that defaults to the current directory.
    • Uses docker/sandbox-templates:devin-docker as the base image for Devin sandboxes, with support for customization to pre-install tools.
    • Reads AGENTS.md from the workspace directory to supply agent-specific instructions to Devin inside the sandbox.
    • Runs Devin with --permission-mode dangerous --respect-workspace-trust=false as the default startup command inside the sandbox.
    • Manages reusable Devin credentials on the host after first interactive sign-in and supplies them to future Devin sandboxes automatically through a proxy.

    5 details in Everything

49. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes adds mountless sandbox support, named sandbox reattachment, sbx cp file transfer, and read-only workspace mounts.

    └──▷ TRY IT
    Create a mountless scratch sandbox and attach to it later — useful when you want an isolated environment with no host files exposed.
    copy

    $ sbx create --name scratch claude
    sbx run --name scratch

    Pull generated output or logs out of a running sandbox to the host without needing a mounted workspace.
    copy

    $ sbx cp my-sandbox:/home/agent/workspace/output.log ./
    sbx cp ./config.json my-sandbox:/home/agent/workspace/

    • Adds mountless sandbox creation via sbx create --name <name> <agent> (no host directory bind mount) and later attachment with sbx run --name <name>, available from version 0.42.0.
    • Adds sbx cp to copy files between host and sandbox by absolute sandbox path, e.g. sbx cp ./config.json my-sandbox:/home/agent/workspace/ and sbx cp my-sandbox:/home/agent/workspace/output.log ./.
    • Supports appending :ro to a workspace path to mount an extra workspace read-only inside the sandbox.
    • Named sandboxes (via --name) allow reattachment from any working directory by running sbx run --name <name> without specifying the agent again.
    • Adds mountless sandbox creation via sbx create --name <name> <agent> (no host directory bind mount) and later attachment with sbx run --name <name>, available from version 0.42.0.
    • Adds sbx cp to copy files between host and sandbox by absolute sandbox path, e.g. sbx cp ./config.json my-sandbox:/home/agent/workspace/ and sbx cp my-sandbox:/home/agent/workspace/output.log ./.
    • Named sandboxes (via --name) allow reattachment from any working directory by running sbx run --name <name> without specifying the agent again.

    1 more in Everything

50. docs update Sep 7, 2026 · issue 067

    Docker Sandboxes adds a machine-wide MSI installer for administrator-managed Windows deployments.

    └──▷ TRY IT
    Silently deploy Docker Sandboxes to all users on a managed Windows fleet from an elevated PowerShell prompt.
    copy

    $ msiexec.exe /i DockerSandboxesMachine.msi /quiet

    • Adds DockerSandboxesMachine.msi for silent, machine-wide installation via msiexec.exe /i DockerSandboxesMachine.msi /quiet, installing to %ProgramFiles%\DockerSandboxes and adding its bin directory to the system PATH — no per-user install required.
    • Adds per-user DockerSandboxes.msi installation via WinGet, placing files in %LOCALAPPDATA%\DockerSandboxes and updating the user PATH without requiring administrator privileges.

    2 details in Everything

51. v0.42.0 Sep 7, 2026 · issue 067

    Docker Sandboxes v0.42.0 adds cloud-hosted sandboxes via sbx --cloud, kit args, env-file args, and a new Devin agent.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.42.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.42.0

    └──▷ TRY IT
    Run a cloud-hosted Claude agent on Docker-managed infrastructure and give it a name for the project session.
    copy

    $ sbx --cloud run claude --name cloud-project

    Check in CI whether the sbx daemon is reachable without parsing human-readable error text.
    copy

    $ sbx version --json | jq -r '.server.state'

    • Adds sbx --cloud to run AI agents on Docker-managed cloud infrastructure with commands such as sbx --cloud run, sbx --cloud cp, sbx --cloud secret, and sbx --cloud policy for file transfer, credentials, and outbound network policy.
    • Adds sbx move to copy a sandbox filesystem between local and cloud environments.
    • Adds --json output to read-only commands including secret ls, version, mcp ls, skills ls, policy inspect, and the kit verification commands.
    • Adds sbx skills to add, update, list, and remove sandbox skills directly from Git repositories.
    • Adds sbx version --json reporting of a server.state field with values running or unavailable so scripts can check backend reachability without parsing error text.

    +17 more show less

    • Adds sbx mcp auth scope control: requests only chosen scopes, accepts a new --no-scope flag to suppress server-required scopes, and reports granted/requested/supported scope sets in sbx mcp auth status.
    • Adds --skip-auth flag to sbx mcp add (the old --skip_auth still works) and allows --url on private, loopback, or cloud-metadata addresses with a warning instead of rejection.
    • Kits can now declare arguments in an args: block and receive values with --kit-arg name=value or --kit-arg kit.name=value to target a single kit; a kits: entry in sbxenv.yaml carries per-kit args under kits[].args.
    • Environment files can now declare their own arguments in an args: block, referenced as ${{ env.args.NAME }} and supplied with sbx env --env-arg.
    • Adds sbx run <sandbox-kit-ref> as the new positional form; the old sbx run <sandbox-kit-name> --kit <sandbox-kit-ref> is deprecated and --kit is now for mixins only.
    • Sandboxes can now be created without a workspace bind mount by omitting the path in sbx create.
    • Sets the default sandbox Docker volume to 10 GB (down from 50 GB) to reduce host disk usage; configurable via the DOCKER_SANDBOXES_DOCKER_SIZE environment variable.
    • Adds Devin as a built-in agent.
    • Adds a machine-wide Windows MSI installer (DockerSandboxes.msi) for administrator-managed installations.
    • sbx env now reads a non-hidden sbxenv.yaml in preference to .sbxenv.yaml when both are present, and merges sbxenv.yaml from the home directory as shared project defaults.
    • sbx env now shows a plan of everything an environment file changes on the host — lifecycle: commands, credentials, bindings, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers, workspaces, kits, ports, and the sandbox itself — and prompts before applying; controlled by env.rememberHostCommands.
    • A registry mirror configured with platform.images.registryMirror is now also used by Docker running inside a sandbox when the value is a bare host with no path prefix.
    • Docker Sandboxes can now upload a diagnostics bundle automatically when the daemon hits an error, after opt-in.
    • A declined @requireApproval prompt on a local MCP server now generates its own audit record with policy attribution and a context digest.
    • Governance resolution issues are now shown in sbx policy output and the dashboard.
    • sbx env create now shares imported skills by default and accepts display, GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference., and USB options in sbxenv.yaml.
    • Clipboard commands inside local sandboxes can now copy text to the host clipboard.
    • Adds sbx --cloud to run AI agents on Docker-managed cloud infrastructure with commands such as sbx --cloud run, sbx --cloud cp, sbx --cloud secret, and sbx --cloud policy for file transfer, credentials, and outbound network policy.
    • Adds sbx move to copy a sandbox filesystem between local and cloud environments.
    • Adds sbx skills to add, update, list, and remove sandbox skills directly from Git repositories.
    • Kits can now declare arguments in an args: block and receive values with --kit-arg name=value or --kit-arg kit.name=value to target a single kit; a kits: entry in sbxenv.yaml carries per-kit args under kits[].args.
    • Environment files can now declare their own arguments in an args: block, referenced as ${{ env.args.NAME }} and supplied with sbx env --env-arg.

    +4 more show less

    • Adds Devin as a built-in agent.
    • Adds a machine-wide Windows MSI installer (DockerSandboxes.msi) for administrator-managed installations.
    • Docker Sandboxes can now upload a diagnostics bundle automatically when the daemon hits an error, after opt-in.
    • Clipboard commands inside local sandboxes can now copy text to the host clipboard.

    13 more in Everything

    └──▷ BREAKING ON UPGRADE

    • !sbx ports --publish and kit-declared ports now default to tcp4 instead of dual-stack tcp, so a published port no longer listens on ::1; use --publish 8080:3000/tcp to restore dual-stack behaviour.
    • !${VAR} interpolation in .sbxenv.yaml is no longer expanded; use the new args: block with ${{ env.args.NAME }} syntax instead.
    • !An environment file that declares no workspace: now creates a sandbox with no workspace bind mount; write workspace: . to mount the project directory as before.
52. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes adds dynamic secret sources via --ref and --command flags, with configurable caching and fallback keychain storage on Linux.

    └──▷ TRY IT
    Pull an Anthropic API key from 1Password at runtime so the real credential is never stored in the sandbox — useful for teams that rotate secrets centrally.
    copy

    $ docker sandbox credentials set anthropic --ref 'op://Work/Anthropic/credential' --refresh 30m

    Use the authenticated GitHub CLI on the host to supply a refreshing token for agents that open PRs or call GitHub APIs, avoiding any stored secret.
    copy

    $ docker sandbox credentials set github --command 'gh auth token' --refresh on-demand

    Register an AWS Secrets Manager secret for OpenAI using a specific AWS profile, storing the ARN reference rather than the key value.
    copy

    $ AWS_PROFILE=prod docker sandbox credentials set openai --ref 'arn:aws:secretsmanager:us-west-2:123456789012:secret:openai-api-key'

    • Adds --ref flag to register a dynamic secret source using a 1Password secret reference (op://...) or AWS Secrets Manager ARN (arn:aws:secretsmanager:...), resolved at runtime by the host CLI rather than stored as a plaintext value.
    • Adds --command flag to register any host tool that prints a secret to stdout (e.g., 'gh auth token') as a dynamic secret source, with the command text stored and replayed by the daemon.
    • Adds --refresh <duration> flag to control how long resolved service secrets are cached (default 55 minutes); pass --refresh on-demand to resolve on every credential use instead of caching.
    • Adds --no-verify flag to store a dynamic secret source that cannot be resolved at registration time, and --show-error to surface provider error output when initial verification fails (the two flags cannot be combined).
    • Supports OP_ACCOUNT and AWS_PROFILE environment variables to select a specific 1Password account or AWS profile when the daemon resolves a --ref secret.

    +4 more show less

    • Supports --ref and --command as dynamic secret sources for custom secrets, replacing --value; --refresh and verification flags apply the same way as for service secrets.
    • On Linux hosts without a running Secret Service (headless servers, some WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. setups), credentials fall back to a file under the user config directory with restricted file permissions, with a warning: 'No keychain detected - this secret will be stored on disk, protected by file permissions rather than a password'.
    • --ref and --command are mutually exclusive and cannot be combined with --token, --oauth, or --registry.
    • Third-party kits that extend a built-in agent inherit its credentials but not its built-in provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build., requiring explicit approval; proxy-managed OAuth is not supported for third-party sandbox agents.

    9 details in Everything

53. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes gains experimental NVIDIA GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. passthrough via VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space., exposed through a new --gpu flag on sbx create and sbx run.

    └──▷ TRY IT
    Enable the experimental GPU feature flag, then launch a sandbox with NVIDIA GPU passthrough for running GPU-accelerated AI workloads.
    copy

    $ sbx settings set platform.allowExperimentalFeatures true
    sbx settings set feature.sandbox-gpu true
    sbx create --gpu claude .

    • Adds --gpu flag to sbx create and sbx run for NVIDIA GPU passthrough into sandboxes on x86_64 Linux hosts using VFIO.
    • Adds sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.sandbox-gpu true to enable the hidden --gpu flag.
    • Introduces prepare-nvidia-bundle.sh build script (distributed via nerdbox-nvidia-modules-x86_64.zip per release) to assemble and install the required EROFS driver bundle at /usr/libexec/nerdbox-nvidia-bundle.erofs.
    • Supports OUTPUT environment variable to override the bundle's install path (default /usr/libexec/nerdbox-nvidia-bundle.erofs) and ACCEPT_NVIDIA_LICENSE=1 for non-interactive/CI builds.
    • Requires host-side setup: IOMMU enabled in BIOS, and iommufd and vfio_pci kernel modules loaded via sudo modprobe -a iommufd vfio_pci.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !After upgrading Docker Sandboxes, the NVIDIA kernel modules in the bundle must be rebuilt to match the new guest kernel — download the new release's nerdbox-nvidia-modules-x86_64.zip and re-run prepare-nvidia-bundle.sh.
54. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes adds remote control support and Ollama provider option for Claude Code sandboxes

    └──▷ TRY IT
    Run a Claude Code sandbox against a local Ollama installation using a specific model instead of the default cloud provider.
    copy

    $ sbx run --model gemma4 --provider ollama claude

    • Enables Claude Code's /remote-control command inside a sandbox via the claude.remoteControl setting.
    • Adds --provider ollama flag to sbx run to use an existing Ollama installation instead of the default provider, e.g. sbx run --model gemma4 --provider ollama claude.

    2 details in Everything

55. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes gains sbx env commands and .sbxenv.yaml environment files for repeatable, shareable sandbox configs

    └──▷ USE IT
    Bootstrap a shared web-app sandbox with Playwright tooling and a published dev port — teammates run the same command to get an identical environment.
    .sbxenv.yaml copy

    # web-app-env/.sbxenv.yaml
    schemaVersion: "1"
    name: web-app
    agent: claude
    workspace: ./web-app
    kits:
      - docker.io/sbx/playwright-kit:latest
    env:
      NODE_ENV: test
    ports:
      - sandbox: 3000
        host: 3000
    
    # Then, from web-app-env/:
    sbx env run

    Layer a personal memory override on top of a committed team config without editing the shared file — useful when your machine has more RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. than the team baseline.
    copy

    $ sbx env run base.sbxenv.yaml local.sbxenv.yaml

    Run automated tests inside a sandbox in CI: create it headlessly, execute the test suite, then tear it down — secrets resolve on the runner, never stored in the file.
    copy

    $ sbx env create
    sbx env exec -- npm test
    sbx env rm --force

    • Adds sbx env run [PATH...], sbx env create [PATH...], sbx env exec [PATH...] -- COMMAND [ARG...], and sbx env rm [PATH...] lifecycle commands (requires sbx 0.39.0+) for managing sandbox environments from a declarative file.
    • Introduces .sbxenv.yaml (fallback: .sbxenv.yml) environment files with schemaVersion, name, agent, kits, workspace, additionalWorkspaces, env, sandboxOptions, secrets, bindings, registries, mcp, and ports top-level fields.
    • Supports multi-file merge via sbx env run base.sbxenv.yaml local.sbxenv.yaml: nested mappings merge by key, lists concatenate, and later scalar values override earlier ones — enabling team base configs plus per-machine overrides.
    • Adds additionalWorkspaces field with per-entry path and readOnly support, allowing the agent to mount multiple repositories simultaneously (e.g. readOnly: true for docs repos).
    • Adds sandboxOptions field supporting template, memory (e.g. 8g, 512m), cpus, pullPolicy (always/missing/never), and profile (governance profile name).

    +7 more show less

    • Adds secrets field mapping service names to secret sources via value (literal), ref (vault URI such as op://Vault/Item/field), or command (host shell command), with optional refresh, backend (sdk/cli), and noVerify per entry.
    • Adds bindings field for approving credential injection domains, merging into the host-global credentials.yaml; sbx env rm --prune-bindings removes declared global bindings on teardown.
    • Adds registries field mapping registry hostnames (e.g. ghcr.io) to pull credentials, supporting token-only credentials (omit username) or username+secret pairs, each using value/ref/command secret sources.
    • Adds mcp.servers list to register MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers (remote via url or local stdio via command/args) with the built-in MCP gateway; registrations are host-global and persist across sbx env rm.
    • Adds ports field for declaring sandbox-to-host port mappings at creation time, with sandbox, host, protocol (tcp/tcp4/tcp6/udp/udp4/udp6), and hostIP per entry.
    • Adds workspace object form with path and clone (boolean, default false) fields; --clone / --clone=false CLI flags override workspace.clone per invocation.
    • Adds sbx settings set kit.allowedSources to configure the kit source allowlist, enabling Git kits from sources beyond the default Docker Hub allowlist.

    12 details in Everything

56. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes adds dynamic credential sources: host CLI commands, 1Password, and AWS Secrets Manager for proxy-injected secrets.

    └──▷ TRY IT
    Inject a GitHub token from the host CLI on every sandbox credential use without ever copying the token into a secret store.
    copy

    $ github --command 'gh auth token' --refresh on-demand

    Source Anthropic and GitHub credentials from 1Password on the host, keeping real values out of the sandbox.
    copy

    $ github --ref 'op://Work/GitHub/token' anthropic --ref 'op://Work/Anthropic/credential'

    Pull an Anthropic API key from AWS Secrets Manager using its ARN so the sandbox proxy resolves it via the authenticated AWS CLI on the host.
    copy

    $ anthropic --ref 'arn:aws:secretsmanager:us-west-2:123456789012:secret:anthropic-api-key'

    • Supports --command as a dynamic secret source, running a host CLI command (e.g. gh auth token) to resolve credentials at runtime, with a 55-minute cache and --refresh on-demand to bypass caching per credential use.
    • Supports --ref with 1Password CLI references (e.g. op://Work/GitHub/token) so the daemon calls 1Password on the host at proxy time — the real value never enters the sandbox.
    • Supports --ref with AWS Secrets Manager ARNs (e.g. arn:aws:secretsmanager:…) so the daemon calls AWS Secrets Manager when the proxy needs the credential.
    • Adds --refresh on-demand policy flag to force credential re-fetch on every use, overriding the 55-minute default cache.
    • Adds sandbox environment files as a declarative alternative to per-flag credential configuration.

    5 details in Everything

57. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes gains sbx prune for cleanup and -e/--env/--env-file flags for environment variable injection.

    └──▷ TRY IT
    Preview which stopped sandboxes would be pruned, excluding any stopped within the last week, before committing to removal.
    copy

    $ sbx prune --dry-run --filter since=168h

    Inject a debug log level and a host-side API URL into a sandbox at launch without baking them into the image.
    copy

    $ export API_URL=https://api.example.com
    sbx run -e LOG_LEVEL=debug -e API_URL --env-file .env.sandbox claude

    Persist a new variable across all future sessions of an existing sandbox without stopping it.
    copy

    $ sbx exec -d my-project bash -c "echo 'export INTERNAL_API_URL=https://api.example.com' >> /etc/sandbox-persistent.sh"

    • Adds sbx prune to remove all stopped local sandboxes, with --dry-run to preview removals and --filter since=<duration> (e.g. since=168h) to exclude recently stopped sandboxes.
    • Adds -e/--env flag to sbx run and sbx create to set individual environment variables in a sandbox, including copying values from the host by specifying a name without a value (requires v0.39.0+).
    • Adds --env-file flag to sbx run and sbx create to load multiple environment variables from one or more files, following docker run precedence rules (requires v0.39.0+).
    • Adds sbx exec -e and sbx exec --env-file to set environment variables for a single exec session without altering the sandbox's stored environment.
    • Supports persisting environment variables across future sandbox sessions by appending exports to /etc/sandbox-persistent.sh, which is sourced when Bash starts inside the sandbox.

    +1 more show less

    • Adds sbx secret set-custom (experimental) to inject credentials for known hosts via the host-side proxy without exposing values to the agent.

    6 details in Everything

58. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes adds .sbxenv.yaml for declaring repeatable local sandbox configurations

59. docs update Aug 19, 2026 · issue 050

    Docker Sandboxes introduces the sbx CLI for running AI coding agents in isolated microVMs on macOS, Windows, and Linux.

    └──▷ TRY IT
    Install sbx on Linux alongside Docker Engine in one step — useful for a fresh CI runner or developer VM.
    copy

    $ curl -fsSL https://get.docker.com | sudo SBX=1 sh

    Install sbx on Linux without Docker Engine when you only need the sandbox runtime, then authenticate.
    copy

    $ curl -fsSL https://get.docker.com | sudo REPO_ONLY=1 sh
    sudo apt-get install docker-sbx
    sbx login

    Install sbx on macOS via Homebrew and sign in to start running AI agent sandboxes.
    copy

    $ brew trust docker/tap && brew install docker/tap/sbx && sbx login

    • Adds the sbx CLI to run AI coding agents in isolated microVMs — no Docker Desktop or Docker Engine required.
    • Installs on macOS via brew install docker/tap/sbx after brew trust docker/tap.
    • Installs on Windows via winget install -h Docker.sbx.
    • Installs on Linux alongside Docker Engine by passing SBX=1 to Docker's convenience script (curl -fsSL https://get.docker.com | sudo SBX=1 sh).
    • Installs on Linux without Docker Engine by adding Docker's apt repository and installing the docker-sbx package via sudo apt-get install docker-sbx, using REPO_ONLY=1 with the convenience script.

    +2 more show less

    • Supports manual binary installation from the sbx-releases repository for environments without a package manager.
    • Authenticates via sbx login, which opens a browser for Docker OAuth.

    7 details in Everything

60. v0.39.0 Aug 19, 2026 · issue 050

    Docker Sandboxes v0.39.0 adds declarative .sbxenv.yaml environments, USB passthrough, bulk pruning, and kit signing via Sigstore.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.39.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.39.0

    └──▷ TRY IT
    Commit a .sbxenv.yaml with your project so any contributor can reproduce the exact same sandbox environment with a single command.
    copy

    $ sbx env run

    Pass through a specific USB device to a sandbox on Linux for hardware-in-the-loop agent testing.
    copy

    $ DOCKER_SANDBOXES_FEATURE_SANDBOX_USB=1 sbx create --usb /dev/bus/usb/001/003 my-sandbox

    Inject secrets and config into a sandbox at creation time, mirroring familiar docker run env-var precedence.
    copy

    $ sbx run --env-file .env -e MY_TOKEN=abc123 my-image

    • Adds sbx env run to provision a complete, reproducible sandbox from a .sbxenv.yaml file (defining agent, workspace, kits, env vars, secrets, registry credentials, ports, and resource limits) and open an interactive session.
    • Adds sbx env create, sbx env exec, and sbx env rm to manage the full lifecycle of declarative sandbox environments.
    • Adds experimental --usb flag to sbx create (enabled via DOCKER_SANDBOXES_FEATURE_SANDBOX_USB environment variable) to re-attach specified USB devices inside a sandbox via usbfs; Linux x86_64/ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. only.
    • Adds -e/--env and --env-file flags to sbx run and sbx create for setting environment variables in a sandbox, following docker run precedence rules.
    • Adds sbx prune to bulk-clean stopped sandboxes, with filtering by how long each has been stopped; never removes a running sandbox.

    +9 more show less

    • Adds --provider ollama flag to sbx run --model to select the Ollama backend, replacing the former ollama/ model-name prefix.
    • Adds sbx kit sign and sbx kit verify for signing and verifying kits with cosign-compatible Sigstore signatures, with optional policy enforcement at load time.
    • Adds platform.images.registryMirror setting to redirect Docker Hub-resolving sandbox template and kit images to an organization's registry mirror.
    • Exposes SANDBOX_NAME and SANDBOX_ID environment variables inside sandboxes, matching the values shown by sbx ls --json.
    • Enables Claude Code's /remote-control inside sandboxes via sbx settings set claude.remoteControl true.
    • Supports combining multiple .sbxenv.yaml environment files for shared configuration and local overrides, with host environment variable references for machine-specific paths and credentials.
    • Adds dynamic secret support to sbx secret set and sbx secret set-custom, with options to control refreshing, verification, and error output.
    • Extends sbx diagnose to report free disk space on the volume holding sandbox data and detect broken, shadowed, or stale SSH client configuration.
    • Allows OAuth kits to declare their credential file using the declarative credentialFile.structure form, rendered to well-formed JSON.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !sbx run --model no longer accepts the ollama/ prefix to select the Ollama backend; use the new --provider ollama flag instead.
    • !The SANDBOX_VM_ID environment variable inside sandboxes is deprecated in favor of SANDBOX_NAME and SANDBOX_ID.
    • !Ubuntu 25.10 packages are no longer published (Ubuntu 25.10 is end-of-life).
61. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds network access policies with sbx policy allow network and sbx policy deny network commands for controlling outbound sandbox connections.

    └──▷ TRY IT
    Allow a sandbox to reach a specific API host while blocking an ad network — useful for locking down egress in a local dev environment.
    copy

    $ sbx policy allow network api.example.com
    sbx policy deny network ads.example.com

    • Adds sbx policy allow network and sbx policy deny network commands to manage local outbound network rules for sandboxes, accepting hostnames, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges, ports, and wildcard patterns (e.g. *.example.com, **.example.com, example.com:443, 10.0.0.0/8).
    • Supports connect:tcp and connect:udp rule actions for network access policies, enabling TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it./UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery.-level control over sandbox egress.
    • Introduces organization-level network policies that apply centrally across an organization or to selected teams, overriding local allow rules when organization governance is active.
    • Local deny rules remain enforced on top of organization policies even when organization governance is active, while local allow rules are suppressed until governance no longer applies.
    • MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. access policies control Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server registration and requests through Docker's MCP gateway; direct MCP connections from a sandbox bypass the gateway but can be restricted via network policy.

    5 details in Everything

62. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes gains org-level governance policies with team scoping, MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. access control, and a Governance API for programmatic management.

    └──▷ TRY IT
    Force-pull the latest org policies immediately after an admin update, without waiting up to 5 minutes for automatic propagation.
    copy

    $ sbx policy reset

    • Adds organization-level governance policies (Network access, Filesystem access, MCP access) managed via the AI Platform section in Docker Home, overriding local sbx policy allow rules while preserving local deny rules.
    • Adds sbx policy reset CLI command to immediately stop the daemon and force a pull of the latest organization policies, bypassing the normal up-to-5-minute propagation delay — with a confirmation prompt because it deletes all locally configured policy rules.
    • Adds MCP access policies using Cedar policy statements, controlling server registration (sbx mcp add), tool calls, resource reads, prompt retrieval, and approval gates — evaluated at registration time and at MCP gateway request time.
    • Adds team-scoped policies so admins can apply different sandbox governance rules to specific teams rather than the entire organization; team membership (including IdPIdPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. group-mapping sync) drives which policies apply to each user.
    • Adds a Governance API for programmatic management of network and filesystem policies.

    +2 more show less

    • Adds an optional support message (up to 500 characters) configurable under AI Platform > Manage > Support message in Docker Home, displayed to members when a sandbox action is blocked by organization governance.
    • Introduces Governance permissions for custom roles, allowing non-owner users to manage AI Governance policies.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !When organization governance is active, local sbx policy allow rules are no longer evaluated and cannot expand what the organization permits; only organization allow rules grant access.
63. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes gains sbx policy for local network access control with allow/deny rules, presets, and per-sandbox scoping.

    └──▷ TRY IT
    Initialize a deny-all policy before running sandboxes in a CI pipeline where interactive prompts are unavailable.
    copy

    $ sbx policy init deny-all

    Allow a specific AI provider API globally, then verify the policy resolves correctly before launching an agent.
    copy

    $ sbx policy allow network api.anthropic.com
    sbx policy check network api.anthropic.com

    Create a sandbox with ad-network hosts blocked at creation time, then list its sandbox-scoped rules.
    copy

    $ sbx create --deny-network ads.example.com --deny-network tracker.example.com claude .
    sbx policy ls my-sandbox

    • Adds sbx policy allow network and sbx policy deny network commands to manage outbound network access rules for sandboxes globally or per-sandbox via --sandbox <name>.
    • Adds sbx policy init <preset> for non-interactive environments (CI/headless); accepts allow-all, balanced, or deny-all as values.
    • Adds sbx policy ls to list active rules, with --source (filter by local, org, or kit), --decision (filter by allow or deny), --wide (rule-level detail including rule IDs), and --include-inactive to surface rules disabled by org governance.
    • Adds sbx policy inspect to view a single policy or rule in full detail.
    • Adds sbx policy check network <target> to test whether the current policy would allow a request before running a sandbox; target can be a hostname, host:port, IP address, or URL.

    +7 more show less

    • Adds sbx policy rm network to remove rules by --resource <host> or --id <uuid>, with optional --sandbox <name> scoping.
    • Adds sbx policy reset (with --force to skip confirmation) to delete the local policy store, restart the daemon, and re-prompt for a preset.
    • Adds --deny-network <host> flag to sbx create and sbx run (v0.38.0+) for setting per-sandbox deny rules at creation time; rules appear in sbx policy ls <name> and are removable with sbx policy rm network --sandbox <name> --resource <host>.
    • Introduces three network presets — Open (wildcard allow, equivalent to sbx policy allow network "**"), Balanced (default-deny with allowlist covering AI APIs, package managers, code hosts, registries, and cloud services), and Locked Down (all outbound blocked).
    • Balanced preset (v0.35.0+) additionally allows VS Code domains, Azure Blob Storage (*.blob.core.windows.net), and dhi.io over HTTP.
    • Local deny rules remain evaluated even when org governance is active, enabling tighter restrictions on top of org policy; local allow rules are inactive when org governance is active.
    • Supports comma-separated host lists in a single sbx policy allow network or sbx policy deny network command (e.g., "api.anthropic.com,*.npmjs.org,*.pypi.org").

    12 details in Everything

64. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. policy support, letting organizations govern Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. activity via Cedar rules in the MCP namespace.

    • Adds MCP policies — organization-level Cedar policies written in the MCP namespace — to control Model Context Protocol activity through Docker's MCP gateway, separate from network and filesystem rule formats.
    • MCP policy enforces a default-deny posture: all MCP activity is blocked unless a matching permit allows it, and a matching forbid overrides any permit including approval-required ones.
    • Registration rules govern future sbx mcp add operations; use-time rules control tool calls, gateway meta-tools, resource reads, and prompt retrieval from already-registered or loaded servers.
    • Clarifies organization governance precedence: when governance is active, only organization allow rules grant access; local and kit-defined allow rules are inactive but their deny rules still apply for network access.

    4 details in Everything

65. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes gains layered governance with network, filesystem, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. access policies plus a programmatic AI Governance API.

    • Adds org-level governance configured centrally in Docker Home, applying network and filesystem policies uniformly across every sandbox in the organization — when active, only organization allow rules grant access; local allow rules are no longer evaluated, while local deny rules still apply on top.
    • Adds MCP access policies to control MCP server registration, tool calls, resources, prompts, and approval gates within sandboxes.
    • Adds network access policies to control outbound network access from sandboxes, configurable per-developer via the CLI or centrally via organization policies.
    • Adds filesystem access policies to control which host paths sandboxes can mount as workspaces.
    • Adds monitoring policies to inspect active rules and monitor sandbox network traffic.

    +3 more show less

    • Adds an AI Governance API to manage network and filesystem org policies programmatically.
    • Adds endpoint management enforcement to require developers to sign in as organization members, preventing policy bypass via personal accounts.
    • Publishes an MCP policy reference covering Docker MCP policy actions, resources, attributes, context fields, and approval behavior.

    8 details in Everything

66. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes gains upstream proxy configuration with sbx settings set proxy, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration., SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead., per-scope exclusions, and Windows integrated auth.

    └──▷ TRY IT
    Route all sandbox traffic through a corporate SOCKS5 proxy while keeping daemon traffic on the shared HTTP proxy — useful when sandboxes must egress through a different network path.
    copy

    $ sbx settings set proxy http://proxy.corp:3128
    sbx settings set proxy.sandbox socks5://proxy.corp:1080

    Enable Windows integrated auth (NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent./KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application.) for corporate proxies that issue 407 challenges, so your Windows identity is used without embeddingembeddingLists of numbers a model produces to represent the meaning of text, images or code, so similar items sit close together. They power semantic search and RAG. credentials in the URL.
    copy

    $ sbx settings set proxy.integratedAuth true

    • Adds sbx settings set proxy <value> to configure an upstream proxy for all outbound traffic, supporting http://, https://, socks5://, socks5h://, pac+http://, pac+https://, file:///, system, and direct values.
    • Adds sbx settings set proxy.sandbox <value> to override the upstream proxy for sandbox traffic only (network access from inside sandboxes), independently of daemon traffic.
    • Adds sbx settings set proxy.daemon <value> to override the upstream proxy for the sbx daemon's own traffic (image pulls, telemetry, sign-in, feature flags) independently of sandbox traffic.
    • Adds sbx settings set no_proxy <list> to exclude destinations from the proxy for both traffic kinds, accepting comma-separated hosts, domain suffixes, IP addresses, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. ranges, or *.
    • Adds sbx settings set no_proxy.sandbox <list> and sbx settings set no_proxy.daemon <list> for scope-specific proxy exclusion lists.

    +4 more show less

    • Adds sbx settings set proxy.integratedAuth true to enable Windows integrated authentication (NTLM/Kerberos Negotiate) for proxies that challenge with a 407 response; off by default.
    • Honors DOCKER_SANDBOXES_PROXY and DOCKER_SANDBOXES_NO_PROXY environment variables as the environment-variable form of proxy.sandbox and no_proxy.sandbox, applying to sandbox traffic only.
    • Honors standard HTTP_PROXY, HTTPS_PROXY, and NO_PROXY (and lowercase forms) as fallback proxy settings for both traffic kinds when no explicit proxy or no_proxy setting is configured.
    • On macOS and Windows, sbx tracks OS-level proxy changes (network switches, VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection., PAC updates) live without requiring a daemon restart, including when system or a PAC proxy is in use.

    9 details in Everything

67. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds upstream proxy support and an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway for brokering access to registered MCP servers.

    • Adds upstream proxy support (experimental) for sandbox and daemon traffic, configurable via proxy URL, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file, or SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy — only HTTP and HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. traffic can be forwarded; other TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. traffic cannot be redirected.
    • Introduces an MCP gateway endpoint on the host side of the sandbox boundary that brokers access to registered MCP servers, including remote endpoints and local stdio servers (optionally packaged as OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. images or registered with an explicit docker command).
    • Enforces MCP policies at the gateway layer — server registration is checked before storage, and governed requests are checked before tool calls, resource reads, prompt retrieval, or gateway meta-tool execution.

    3 details in Everything

68. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes gains an MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway with sbx mcp commands for registering, authorizing, and live-loading Model Context ProtocolModel Context ProtocolModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. servers into isolated sandboxes.

    └──▷ TRY IT
    Register a remote OAuth-backed MCP server and launch a Claude sandbox with it pre-loaded in static mode.
    copy

    $ sbx mcp add notion --url https://mcp.notion.com/mcp
    sbx run claude --name mcp-demo --static-mcp notion

    Register a confidential OAuth client for Slack, storing the secret before registration so it never appears in the MCP config.
    copy

    $ sbx secret set mcp:slack.client_secret
    sbx mcp add slack --url https://slack.example.com/mcp --client-id <CLIENT_ID>

    Attach a newly registered MCP server to an already-running sandbox without restarting it.
    copy

    $ sbx mcp add linear --url https://mcp.linear.app/mcp
    sbx mcp load linear --sandbox my-session

    • Adds sbx mcp add <name> --url <url> to register remote MCP servers (e.g. sbx mcp add notion --url https://mcp.notion.com/mcp) on the host for reuse across sandboxes.
    • Adds --local flag to sbx mcp add to resolve OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant.-packaged stdio MCP servers from a community registry URL, server.json, or server.yaml manifest and run them on the host with Docker.
    • Adds --command and --args flags to sbx mcp add for registering explicit stdio MCP servers (e.g. npx, docker run) on the host, plus --dir to set the working directory (only valid with --command).
    • Adds --skip_auth flag to sbx mcp add to register an OAuth-backed remote server without immediately starting the authorization flow.
    • Adds --client-id flag to sbx mcp add for pre-registered OAuth clients that do not support Dynamic Client Registration.

    +8 more show less

    • Adds --oauth-authorization-server flag to sbx mcp add accepting a local file path or HTTP/HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. URL to an RFC 8414 authorization server metadata document, for servers that don't publish OAuth metadata.
    • Adds sbx secret set mcp:<server>.client_secret to store a confidential OAuth client secret in the encrypted host credential store before registering a server.
    • Adds repeatable --scope flag to sbx mcp add and sbx mcp auth to record or override default OAuth scopes requested during authorization.
    • Adds sbx mcp auth <server>, sbx mcp auth status <server>, and sbx mcp auth rm <server> commands to manage OAuth credentials from the host, with --all to act on all OAuth-backed servers and --format=json for machine-readable output.
    • Adds sbx mcp ls to list all registered MCP servers by name, type, and URL/command.
    • Adds --static-mcp flag to sbx run to pre-load one or more registered MCP servers into a sandbox at startup (comma-separated or repeated); sandboxes started without --static-mcp enter dynamic mode.
    • Adds sbx mcp load <name> --sandbox <sandbox-name> to attach an already-registered server to a running sandbox in both static and dynamic modes, with live tool-list updates to connected agents.
    • Adds built-in gateway tools visible to agents on the MCP connection: mcp-exec, code-mode, mcp-find (dynamic mode only), mcp-add (dynamic mode only), mcp-config-set (dynamic mode only), and per-server <server>-authorize for OAuth-backed servers.

    13 details in Everything

69. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes agent now supports six additional LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. providers including Anthropic, Google, xAI, Nebius, Mistral, and OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code.

    • Adds support for anthropic, google, xai, nebius, mistral, and openrouter as LLM providers alongside the existing openai integration.

    1 detail in Everything

70. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds experimental --model flag to route Claude Code API calls to a local model server, Ollama, or Docker Model Runner.

    └──▷ TRY IT
    Run Claude Code in a sandbox using a locally bundled model instead of Anthropic's API — useful for air-gapped environments or cost control.
    copy

    $ sbx settings platform.allowExperimentalFeatures true
    sbx settings feature.model true
    sbx run --model gemma4 claude

    Route Claude Code to an already-running Ollama instance for teams that manage their own local model infrastructure.
    copy

    $ sbx run --model ollama/gemma4 claude

    • Adds experimental --model flag to sbx run to route Claude Code's Anthropic API requests to a locally served model (not supported on Windows).
    • Enables llmman, a bundled model server that accepts GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. model references or short names (e.g. gemma4); sbx starts the server on first use, pulls the model, and reuses the running server and model store for subsequent sandboxes.
    • Supports routing to an existing Ollama installation via the ollama/ prefix (e.g. --model ollama/gemma4); sbx connects to Ollama but does not manage its lifecycle.
    • Adds sbx settings platform.allowExperimentalFeatures true and sbx settings feature.model true config commands required to enable the --model feature.
    • Allows changing the model on an existing sandbox with sbx run --name <sandbox-name> --model <model-name>; the sandbox container is recreated while workspace and kit-owned volumes persist.

    5 details in Everything

71. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds scoped secret management with sbx secret set and organization-level policy controls.

    └──▷ TRY IT
    Store an Anthropic API key as a global secret so all future sandboxes can authenticate to the Anthropic service.
    copy

    $ sbx secret set anthropic -t "$ANTHROPIC_API_KEY"

    Store a registry credential scoped to a single named sandbox to avoid leaking credentials to other sandboxes.
    copy

    $ sbx secret set github --registry ghcr.io --sandbox my-dev-sandbox

    • New sbx secret set <service> command stores service secrets for use in sandboxes, defaulting to global scope (all future sandboxes).
    • Adds --sandbox <sandbox-name> flag to sbx secret set for per-sandbox secret scoping instead of global.
    • Adds --all-sandboxes flag to sbx secret set to explicitly apply a secret across all sandboxes.
    • Adds --registry flag (e.g., --registry ghcr.io, --registry myregistry.azurecr.io) to sbx secret set for per-registry credential scoping.
    • Supports named service targets including github and anthropic as arguments to sbx secret set.

    +1 more show less

    • Introduces organization policies — admin-controlled network, filesystem, and MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. policies that take precedence over local policy across all developers.

    6 details in Everything

72. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds centralized MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway and upstream proxy policy controls for enterprise teams.

    • Adds MCP gateway support to register MCP servers and connect them to sandboxed agents.
    • Adds upstream proxy routing so sandbox and daemon traffic can be directed through a corporate proxy, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file, or OS system proxy.
    • Introduces centralized admin policies to uniformly enforce sandbox network, filesystem, and MCP controls across every developer's machine (separate paid subscription required).

    3 details in Everything

73. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds centralized MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway and upstream proxy controls for enterprise sandbox policy management.

    • Adds MCP gateway support to register MCP servers and connect them to sandboxed agents, enabling controlled tool access for AI workloads.
    • Adds upstream proxy configuration to route sandbox and daemon traffic through a corporate proxy, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file, or the OS system proxy.
    • Introduces centralized policy management for sandbox network, filesystem, and MCP policies, enforced uniformly across every developer's machine (available on a separate paid subscription).

    3 details in Everything

74. docs update Aug 14, 2026 · issue 045

    Docker Sandboxes adds centralized MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. gateway and upstream proxy controls for enterprise sandbox policy management.

    • Adds MCP gateway support to register MCP servers and connect them to sandboxed agents, enabling centrally managed MCP policies across developer machines.
    • Adds upstream proxy configuration to route sandbox and daemon traffic through a corporate proxy, PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. file, or OS system proxy.
    • Introduces centralized admin controls for sandbox network, filesystem, and MCP policies, enforced uniformly across every developer's machine (available as a separate paid subscription).

    3 details in Everything

75. docs update Aug 6, 2026 · issue 037

    Docker Sandboxes daemon now writes local audit logs as JSON Lines files with policy decision and session lifecycle records.

    └──▷ TRY IT
    Confirm that governance is active and audit logging is enabled before relying on local audit records.
    copy

    $ sbx policy ls

    • Adds local audit log delivery: the sandbox daemon writes audit records as .jsonl.jsonlA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. files (JSON Lines format) to a per-OS directory, independent of cloud delivery.
    • Default audit log paths are ~/Library/Logs/com.docker.sandboxes/sandboxes/auditkit/ (macOS), ${XDG_STATE_HOME:-~/.local/state}/sandboxes/sandboxes/auditkit/ (Linux), and %LOCALAPPDATA%\DockerSandboxes\sandboxes\logs\auditkit\ (Windows).
    • Audit files are named audit-<utc-timestamp>-<process-uuid>-<seq>.jsonl; in-progress writes use a .tmp extension and are finalized by atomic rename at rotation thresholds of 5 minutes, 1000 events, or 50 MiB.
    • Records two categories of audit event: evaluation records (policy decisions including resource, action, verdict, and deny_reason) and session lifecycle records (daemon start/end), linked by audit_session_id.
    • Audit record fields include audit_event_id, timestamp, schema_version, category, decision, username, user_email, org_id, org_name, audit_session_id, resource_id, os, app_version, client_name, hostname, deny_reason, action_type, and network_egress.

    +2 more show less

    • Supports SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion via log shippers (e.g. Splunk Universal Forwarder, Filebeat, CrowdStrike Falcon LogScale) pointed at the audit directory, collecting .jsonl files only.
    • Use sbx policy ls to confirm governance is active; output includes a Governance: Managed by <org> line when an enforced centralized organization policy is in effect — a prerequisite for audit records to be written.

    7 details in Everything

76. docs update Aug 6, 2026 · issue 037

    Docker Sandboxes 0.35.0 adds AI Governance Audit Logs with local disk, Docker Cloud, CSV export, and SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. streaming delivery modes.

    • New AI Governance Audit Logs feature (requires Docker Sandboxes 0.35.0 or later and an AI Governance subscription) records principal, action, target, decision, and time for governance events — metadata only, no prompt content or parameter values.
    • Supports two delivery modes: local disk (sandbox daemon writes JSON Lines files per host, suitable for air-gapped or custom log-shipper setups) and Docker Cloud (stores records centrally, on by default when AI Governance is enabled).
    • Docker Cloud delivery powers a hosted audit log view, CSV export, and SIEM streaming from app.docker.com; local delivery alone does not enable these features.
    • Organization owners can enable, disable, or combine delivery modes via audit delivery settings in app.docker.com; users with a custom role that includes AI Governance audit permissions can also configure delivery and view hosted events.

    4 details in Everything

77. docs update Aug 6, 2026 · issue 037

    Docker Sandboxes adds sbx secret set-custom support for OpenCode Zen API keys with host-side proxy substitution

    └──▷ TRY IT
    Store an OpenCode Zen API key as a global custom secret so all OpenCode sandboxes can authenticate to opencode.ai without exposing the real key inside the sandbox.
    copy

    $ sbx secret set-custom -g \
      --host opencode.ai \
      --env OPENCODE_API_KEY \
      --value "$OPENCODE_API_KEY"

    Allow an OpenCode sandbox to reach the OpenCode Zen API over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. after adding the custom secret.
    copy

    $ sbx policy allow network opencode.ai:443

    • Adds sbx secret set-custom -g --host opencode.ai --env OPENCODE_API_KEY --value to store OpenCode Zen API keys as custom secrets, keeping the real key in the host secret store while the sandbox receives a placeholder that the host-side proxy replaces on requests to opencode.ai.
    • Adds sbx policy allow network opencode.ai:443 requirement for sandboxes using OpenCode Zen, enabling outbound network access to the OpenCode Zen service.

    2 details in Everything

78. v0.38.0 Aug 6, 2026 · issue 037

    Docker Sandboxes v0.38.0 adds local model routing, first-class MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. management, enterprise proxy/NTLMNTLMA Windows authentication protocol that proves knowledge of a password through a challenge and response. Captured authentication exchanges can be abused in relay attacks when protections are absent./KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. support, and per-sandbox network deny rules.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.38.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    └──▷ TRY IT
    Route Claude Code at a local GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. model instead of api.anthropic.com — useful for air-gapped or cost-sensitive environments.
    copy

    $ sbx settings set platform.allowExperimentalFeatures true
    sbx settings set feature.model true
    sbx run --model llama3.2 claude

    Block a sandbox from reaching a specific host at creation time, e.g. to prevent exfiltration to an external service.
    copy

    $ sbx run --deny-network api.example.com claude

    Configure a corporate HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. proxy for all sandbox and daemon traffic with NTLM authentication on Windows.
    copy

    $ sbx settings set proxy http://proxy.corp.example.com:8080
    sbx settings set proxy.integratedAuth true

    • Adds sbx run --model <name> claude to serve a local GGUF model via llmman, or an already-running Ollama install using an ollama/ prefix, routing Claude Code away from api.anthropic.com; enable with sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.model true.
    • Adds sbx mcp as a first-class, no-longer-hidden subcommand for MCP server management.
    • Adds sbx mcp add with --dir and OAuth override flags; registering a server immediately refreshes the mcp-find/mcp-add index in every running sandbox so new servers are discoverable without recreating sandboxes.
    • Adds --deny-network HOST flag to sbx run and sbx create for per-sandbox egress deny rules recorded at creation time.
    • Adds settings-driven upstream-proxy configuration via proxy, proxy.sandbox, proxy.daemon, and matching no_proxy keys, defaulting to the host OS system proxy and proxying daemon traffic (image pulls, telemetry) as well.

    +12 more show less

    • Adds proxy.integratedAuth setting to enable NTLM/Kerberos/Negotiate proxy authentication on Windows.
    • Adds tls.allowNegativeSerial setting for TLS-inspecting proxies that issue certificates with negative serial numbers.
    • Adds sbx run --gpu (experimental) for NVIDIA VFIOVFIOA Linux kernel framework that lets userspace programs take direct ownership of a PCI device, bypassing kernel drivers, giving cyber tools low-latency, isolated hardware access without running in kernel space. GPUGPUA graphics processing unit, a processor that performs many calculations in parallel. AI workloads use GPUs to speed up model training and inference. passthrough on Linux; enable with sbx settings set feature.sandbox-gpu true.
    • Adds sbx daemon restart to stop and restart the sandboxd daemon in the background.
    • Adds DOCKER_SANDBOXES_CLONED_WORKSPACE_SIZE environment variable to configure the size of the cloned workspace volume.
    • Makes dynamic MCP tools mcp-find, mcp-add, and mcp-config-set available in local sandbox mode.
    • Extends sbx mount <sandbox> <host> so omitting a container target bind-mounts the host path at the same path inside the sandbox; :ro mounts are enforced read-only at the virtio-fs host edge.
    • sbx inspect now displays custom secrets configured for a sandbox.
    • Claude Vertex sandboxes now support us and eu multi-region endpoints.
    • Service and custom secrets are now global by default, with --sandbox for sandbox-scoped secrets.
    • Blocked HTTPS proxy connections now appear in sbx policy log even when the client aborts the TLS handshake.
    • Homebrew installs now use a stapled .dmg artifact instead of a .tar.gz archive, improving Gatekeeper compatibility on macOS.

    17 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The sbx mcp bundle command has been removed; single-server management via sbx mcp add/ls/rm is the only supported flow.
    • !Service and custom secrets default to global scope; legacy positional and --global forms are deprecated with warnings.
79. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes org admins can now add a custom support message shown when governance policies block sandbox actions.

    • Adds configurable support message (up to 500 characters) displayed to members when a sandbox action is blocked by organization governance policy, enabling admins to direct users to internal support channels or security contacts.

    1 detail in Everything

80. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes org admins can now add a custom support message shown when governance policies block sandbox actions.

    • Adds configurable support message (up to 500 characters) displayed to members when a sandbox action is blocked by organization governance policy, enabling admins to direct users to internal support channels or security contacts.

    1 detail in Everything

81. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes 0.37.0+ adds ChatGPT desktop app integration via SSH, letting Codex run inside an isolated sandbox instead of on the host.

    └──▷ TRY IT
    Create a named Codex sandbox for your current project and connect the ChatGPT desktop app to it over SSH so Codex runs in isolation.
    copy

    $ sbx create --name demo codex .
    ssh demo.sbx

    After verifying SSH access, wire up the ChatGPT desktop app to the sandbox workspace.
    📍In the ChatGPT desktop app, go to Settings › Connections, add an SSH connection manually, enter demo.sbx as the host, then use the remote folder picker to select the mounted workspace as the remote project.
    • Supports connecting the ChatGPT desktop app to a Docker Sandbox over SSH so OpenAI Codex executes inside the isolated environment rather than on the host machine.
    • Adds a Codex sandbox template that pre-installs the codex command required by the ChatGPT app's remote server.

    2 details in Everything

82. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes 0.37.0+ adds ChatGPT desktop app integration via SSH, letting Codex run inside an isolated sandbox instead of on the host.

    └──▷ TRY IT
    Create a named Codex sandbox for your current project and connect the ChatGPT desktop app to it over SSH so Codex runs in isolation.
    copy

    $ sbx create --name demo codex .
    ssh demo.sbx

    After verifying SSH access, wire up the ChatGPT desktop app to the sandbox workspace.
    📍In the ChatGPT desktop app, go to Settings › Connections, add an SSH connection manually, enter demo.sbx as the host, then use the remote folder picker to select the mounted workspace as the remote project.
    • Supports connecting the ChatGPT desktop app to a Docker Sandbox over SSH so OpenAI Codex executes inside the isolated environment rather than on the host machine.
    • Adds a Codex sandbox template that pre-installs the codex command required by the ChatGPT app's remote server.

    2 details in Everything

83. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes now supports connecting Claude Desktop to a remote sandbox over SSH for isolated AI agent execution.

    └──▷ TRY IT
    Verify SSH connectivity to your sandbox before wiring it up in Claude Desktop.
    copy

    $ ssh demo.sbx

    On Windows, confirm sh.exe is on your PATH to prevent Claude Desktop SSH connection timeouts.
    copy

    $ where.exe sh

    Connect Claude Desktop to a sandbox: open the environment drop-down, select + Add SSH connection, enter a name and the sandbox hostname (e.g. demo.sbx) in SSH Host, leave SSH Port and Identity File empty, then pick the mounted workspace folder.
    📍In Claude Desktop, open the environment drop-down → + Add SSH connection → set SSH Host to demo.sbx → leave SSH Port and Identity File empty → select the mounted workspace via the remote folder picker.
    • Enables Claude Desktop to run Claude Code inside a Docker Sandbox over SSH, keeping agent activity isolated from the host machine.
    • Adds SSH connection workflow in Claude Desktop: select a named sandbox as the remote environment via the environment drop-down and SSH Host field.
    • Provides Windows-specific troubleshooting guidance for SSH connection timeouts caused by missing sh.exe (Git for Windows dependency).

    3 details in Everything

84. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes now supports connecting Claude Desktop to a remote sandbox over SSH for isolated AI agent execution.

    └──▷ TRY IT
    Verify SSH connectivity to your sandbox before wiring it up in Claude Desktop.
    copy

    $ ssh demo.sbx

    On Windows, confirm sh.exe is on your PATH to prevent Claude Desktop SSH connection timeouts.
    copy

    $ where.exe sh

    Connect Claude Desktop to a sandbox: open the environment drop-down, select + Add SSH connection, enter a name and the sandbox hostname (e.g. demo.sbx) in SSH Host, leave SSH Port and Identity File empty, then pick the mounted workspace folder.
    📍In Claude Desktop, open the environment drop-down → + Add SSH connection → set SSH Host to demo.sbx → leave SSH Port and Identity File empty → select the mounted workspace via the remote folder picker.
    • Enables Claude Desktop to run Claude Code inside a Docker Sandbox over SSH, keeping agent activity isolated from the host machine.
    • Adds SSH connection workflow in Claude Desktop: select a named sandbox as the remote environment via the environment drop-down and SSH Host field.
    • Provides Windows-specific troubleshooting guidance for SSH connection timeouts caused by missing sh.exe (Git for Windows dependency).

    3 details in Everything

85. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes now supports Cursor as a Remote-SSH editor, running files and terminals inside isolated sandboxes.

    └──▷ HOW TO FIND IT
    Open a Cursor window connected to a running sandbox so your full dev environment runs in isolation.
    📍ssh demo.sbx # Then in Cursor: Command Palette → Remote-SSH: Connect to Host → enter <name>.sbx
86. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes now supports Cursor as a Remote-SSH editor, running files and terminals inside isolated sandboxes.

    └──▷ HOW TO FIND IT
    Open a Cursor window connected to a running sandbox so your full dev environment runs in isolation.
    📍ssh demo.sbx # Then in Cursor: Command Palette → Remote-SSH: Connect to Host → enter <name>.sbx
87. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes 0.37.0 adds VS Code Remote-SSH integration to develop directly inside isolated sandboxes.

    └──▷ TRY IT
    Open a VS Code window inside a sandbox to develop in an isolated environment without leaving your local editor.
    copy

    $ ssh demo.sbx

    Fix an infinite reconnect loop on macOS when using Remote-SSH with Docker Sandboxes.
    json copy

    { "remote.SSH.useLocalServer": false }

    • Supports connecting VS Code to a running sandbox via the Remote-SSH extension, so files, terminals, and extensions run inside the isolated environment while the editor stays on the host.

    1 detail in Everything

88. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes 0.37.0 adds VS Code Remote-SSH integration to develop directly inside isolated sandboxes.

    └──▷ TRY IT
    Open a VS Code window inside a sandbox to develop in an isolated environment without leaving your local editor.
    copy

    $ ssh demo.sbx

    Fix an infinite reconnect loop on macOS when using Remote-SSH with Docker Sandboxes.
    json copy

    { "remote.SSH.useLocalServer": false }

    • Supports connecting VS Code to a running sandbox via the Remote-SSH extension, so files, terminals, and extensions run inside the isolated environment while the editor stays on the host.

    1 detail in Everything

89. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes adds SSH access so VS Code, Cursor, Claude Desktop, and ChatGPT can connect to running sandboxes as remote hosts.

    └──▷ TRY IT
    One-time SSH setup so editors and apps can reach any sandbox as a remote host.
    copy

    $ sbx setup ssh

    • New sbx setup ssh command configures SSH access to sandboxes, writing a managed block to ~/.ssh/config so any SSH-capable editor or app can connect.
    • Sandboxes are now reachable as SSH hosts via <name>.sbx naming, enabling remote development from VS Code, Cursor, Claude Desktop, ChatGPT, and any other SSH-over-remote tool.
    • SSH connections route through the daemon's local socket (Unix domain socket on macOS/Linux, named pipe on Windows) — no open network port or stored SSH key required.
    • Environment variable forwarding via SendEnv * is supported, filtered by a daemon-side ssh.acceptEnv allowlist; sensitive variables like PATH, LD_*, and NODE_OPTIONS are always blocked.

    4 details in Everything

90. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes adds SSH access so VS Code, Cursor, Claude Desktop, and ChatGPT can connect to running sandboxes as remote hosts.

    └──▷ TRY IT
    One-time SSH setup so editors and apps can reach any sandbox as a remote host.
    copy

    $ sbx setup ssh

    • New sbx setup ssh command configures SSH access to sandboxes, writing a managed block to ~/.ssh/config so any SSH-capable editor or app can connect.
    • Sandboxes are now reachable as SSH hosts via <name>.sbx naming, enabling remote development from VS Code, Cursor, Claude Desktop, ChatGPT, and any other SSH-over-remote tool.
    • SSH connections route through the daemon's local socket (Unix domain socket on macOS/Linux, named pipe on Windows) — no open network port or stored SSH key required.
    • Environment variable forwarding via SendEnv * is supported, filtered by a daemon-side ssh.acceptEnv allowlist; sensitive variables like PATH, LD_*, and NODE_OPTIONS are always blocked.

    4 details in Everything

91. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes adds shared agent skills import, letting Claude Code, Codex, Copilot, Cursor, and Droid skills persist across sandboxes.

    └──▷ TRY IT
    Preview which agent skills would be imported before committing — useful to audit what gets shared across sandboxes.
    copy

    $ sbx skills import --dry-run

    Import host agent skills into the persistent shared store so all future supported-agent sandboxes (v0.37.0+) pick them up automatically.
    copy

    $ sbx skills import

    Run a Claude sandbox that is intentionally excluded from the shared skills store to keep it in its own trust boundary.
    copy

    $ sbx run --no-share-skills claude

    • Adds sbx skills import command to copy agent skills (Claude Code, Codex, Copilot, Cursor, Droid) from host into a persistent shared store mounted into new sandboxes automatically.
    • Adds --dry-run flag to sbx skills import to preview which skills would be copied without committing them to the store.
    • Adds --no-share-skills flag to sbx run to create a sandbox that opts out of the shared skills store, keeping it outside the shared trust boundary.

    3 details in Everything

92. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes adds shared agent skills import, letting Claude Code, Codex, Copilot, Cursor, and Droid skills persist across sandboxes.

    └──▷ TRY IT
    Preview which agent skills would be imported before committing — useful to audit what gets shared across sandboxes.
    copy

    $ sbx skills import --dry-run

    Import host agent skills into the persistent shared store so all future supported-agent sandboxes (v0.37.0+) pick them up automatically.
    copy

    $ sbx skills import

    Run a Claude sandbox that is intentionally excluded from the shared skills store to keep it in its own trust boundary.
    copy

    $ sbx run --no-share-skills claude

    • Adds sbx skills import command to copy agent skills (Claude Code, Codex, Copilot, Cursor, Droid) from host into a persistent shared store mounted into new sandboxes automatically.
    • Adds --dry-run flag to sbx skills import to preview which skills would be copied without committing them to the store.
    • Adds --no-share-skills flag to sbx run to create a sandbox that opts out of the shared skills store, keeping it outside the shared trust boundary.

    3 details in Everything

93. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes now support SSH-based connections from editors like VS Code and Cursor.

    • Enables connecting VS Code, Cursor, and other editors/apps to a Docker Sandbox over SSH.

    1 detail in Everything

94. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes now support SSH-based connections from editors like VS Code and Cursor.

    • Enables connecting VS Code, Cursor, and other editors/apps to a Docker Sandbox over SSH.

    1 detail in Everything

95. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes now support SSH connections from editors like VS Code and Cursor.

    • Enables connecting editors and apps such as VS Code and Cursor to a Docker Sandbox over SSH.

    1 detail in Everything

96. docs update Jul 24, 2026 · docs issue 004

    Docker Sandboxes: Enables connecting editors and apps such as VS Code and Cursor to a Docker Sandbox over SSH.

97. docs update Jul 24, 2026 · issue 024

    Docker Sandboxes now support SSH-based connections from editors like VS Code and Cursor.

    • Supports connecting VS Code and Cursor editors to a Docker Sandbox over SSH.

    1 detail in Everything

98. v0.37.0 Jul 24, 2026 · issue 024

    Docker Sandboxes v0.37.0 adds SSH access to sandboxes, shared agent skills, port publishing, and richer audit records.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.37.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.37.0

    └──▷ TRY IT
    Set up SSH access once so every sandbox becomes reachable by name from any OpenSSH-compatible client or remote-dev tool.
    copy

    $ sbx setup ssh

    Connect to a running sandbox for an interactive shell or one-shot command without leaving your terminal.
    copy

    $ ssh my-sandbox.sbx

    Import host agent skills into the shared store (preview first, then apply) so new sandboxes automatically inherit them.
    copy

    $ sbx skills import --dry-run && sbx skills import --force

    Start a sandbox with a published port and without shared skills, e.g. for an isolated web-service test.
    copy

    $ sbx run -p 8080:8080 --no-share-skills my-image

    • Adds SSH access to sandboxes (experimental): run sbx setup ssh once to register a managed *.sbx SSH config entry, then connect to any sandbox with ssh <name>.sbx from OpenSSH clients or remote-dev tools like VS Code and Cursor.
    • Adds sbx skills import to discover and import host agent skills into a persistent store shared across sandboxes, with --dry-run to preview and --force to overwrite existing skills.
    • New --no-share-skills flag on sbx run / sbx create lets individual sandboxes opt out of the shared skills store.
    • Adds -p/--publish flag to sbx create and sbx run for publishing sandbox ports at creation time.
    • New DOCKER_SANDBOXES_PROXY=system env var routes sandbox egress through the host OS proxy (macOS/Windows), including PACPACA Proxy Auto-Configuration file, a JavaScript snippet a browser or OS fetches to decide which proxy server to route each request through, letting cyber tools intercept or redirect traffic without per-app configuration. auto-config URLs.

    +1 more show less

    • Audit now emits execution-outcome records for network egress (per allowed connection) and filesystem mounts (per allowed path), including success, latency, and error class.

    6 details in Everything

99. v0.35.0 Jul 10, 2026 · issue 012

    Docker Sandboxes v0.35.0 adds SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support, policy inspection/check commands, secret import, and a daemon management CLI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.35.0 https://github.com/docker/sbx-releases.git
    # already have the repo? check out this version:
    $ git checkout v0.35.0

    └──▷ TRY IT
    Before running an agent task, verify that the current policy permits a specific outbound connection — catch misconfigurations without launching the full sandbox.
    copy

    $ sbx policy check network --host api.example.com --port 443

    Route all sandbox egress through a corporate SOCKS5 proxy (with credentials) so sandbox traffic flows through your org's inspection infrastructure.
    copy

    $ DOCKER_SANDBOXES_PROXY=socks5://proxyuser:proxypass@proxy.corp.example.com:1080 DOCKER_SANDBOXES_NO_PROXY=localhost,127.0.0.1 sbx run

    Migrate host env-var credentials (e.g. API keys) into the keychain so they are explicitly managed rather than auto-injected at runtime.
    copy

    $ sbx secret import

    • Adds SOCKS5 upstream-proxy transport (socks5:// / socks5h://) for sandbox egress via DOCKER_SANDBOXES_PROXY, HTTP_PROXY, or HTTPS_PROXY, with optional auth and DOCKER_SANDBOXES_NO_PROXY exclusions.
    • New sbx policy inspect command to examine policy details.
    • New sbx policy check network command to test whether the current policy would allow a network access request before executing.
    • Revamped sbx policy ls with --wide, --source, and --decision filters for concise policy listing.
    • New sbx secret import imports credential env vars into the keychain; sbx secret ls now flags env-only and OAuth-shadowed entries. Host env vars no longer auto-inject at runtime — migration required.

    +10 more show less

    • New sbx daemon command with start, stop, status, and log-level subcommands for daemon lifecycle management.
    • sbx inspect now surfaces the sandbox's kits, injected secrets, and sandbox information.
    • sbx rm now requires --force to delete an active session, preventing accidental teardown.
    • sbx kit add now recreates the sandbox container with the full kit set (preserving state) and applies the kit's network allow/deny rules and composed policy.
    • Kits can inject the user's Docker login token into requests to docker.com hosts via a credential with service sbx-login.
    • Re-attaching to a sandbox created with a custom --kit agent now works via sbx run --name <name> without re-passing --kit.
    • Enables virtiofs caching by default on all operating systems for faster filesystem performance (opt out with DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=0).
    • Balanced network preset now allows VS Code domains, Azure Blob Storage (*.blob.core.windows.net), and dhi.io over HTTP.
    • Droid OAuth credentials are now proxy-managed, keeping real tokens on the host and out of the sandbox.
    • Faster sandbox startup via optimized TLS-proxy CA installation (merging into trust bundle instead of running update-ca-certificates), saving several hundred milliseconds.

    15 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Host env vars no longer auto-inject at runtime — use sbx secret import to migrate existing env-var-based secrets.
    • !sbx rm now won't delete an active session unless --force is passed.
    • !Installation is blocked on Windows versions older than Windows 11.
100. v0.35.0 Jul 10, 2026 · issue 003

     Docker Sandboxes v0.35.0 adds SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support, policy inspection/check commands, secret import, and a daemon management CLI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.35.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.35.0

     └──▷ TRY IT
     Before running an agent task, verify that the current policy permits a specific outbound connection — catch misconfigurations without launching the full sandbox.
     copy

     $ sbx policy check network --host api.example.com --port 443

     Route all sandbox egress through a corporate SOCKS5 proxy (with credentials) so sandbox traffic flows through your org's inspection infrastructure.
     copy

     $ DOCKER_SANDBOXES_PROXY=socks5://proxyuser:proxypass@proxy.corp.example.com:1080 DOCKER_SANDBOXES_NO_PROXY=localhost,127.0.0.1 sbx run

     Migrate host env-var credentials (e.g. API keys) into the keychain so they are explicitly managed rather than auto-injected at runtime.
     copy

     $ sbx secret import

     • Adds SOCKS5 upstream-proxy transport (socks5:// / socks5h://) for sandbox egress via DOCKER_SANDBOXES_PROXY, HTTP_PROXY, or HTTPS_PROXY, with optional auth and DOCKER_SANDBOXES_NO_PROXY exclusions.
     • New sbx policy inspect command to examine policy details.
     • New sbx policy check network command to test whether the current policy would allow a network access request before executing.
     • Revamped sbx policy ls with --wide, --source, and --decision filters for concise policy listing.
     • New sbx secret import imports credential env vars into the keychain; sbx secret ls now flags env-only and OAuth-shadowed entries. Host env vars no longer auto-inject at runtime — migration required.

     +10 more show less

     • New sbx daemon command with start, stop, status, and log-level subcommands for daemon lifecycle management.
     • sbx inspect now surfaces the sandbox's kits, injected secrets, and sandbox information.
     • sbx rm now requires --force to delete an active session, preventing accidental teardown.
     • sbx kit add now recreates the sandbox container with the full kit set (preserving state) and applies the kit's network allow/deny rules and composed policy.
     • Kits can inject the user's Docker login token into requests to docker.com hosts via a credential with service sbx-login.
     • Re-attaching to a sandbox created with a custom --kit agent now works via sbx run --name <name> without re-passing --kit.
     • Enables virtiofs caching by default on all operating systems for faster filesystem performance (opt out with DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=0).
     • Balanced network preset now allows VS Code domains, Azure Blob Storage (*.blob.core.windows.net), and dhi.io over HTTP.
     • Droid OAuth credentials are now proxy-managed, keeping real tokens on the host and out of the sandbox.
     • Faster sandbox startup via optimized TLS-proxy CA installation (merging into trust bundle instead of running update-ca-certificates), saving several hundred milliseconds.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Host env vars no longer auto-inject at runtime — use sbx secret import to migrate existing env-var-based secrets.
     • !sbx rm now won't delete an active session unless --force is passed.
     • !Installation is blocked on Windows versions older than Windows 11.
101. v0.35.0 Jul 10, 2026 · issue 002

     Docker Sandboxes v0.35.0 adds SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. proxy support, policy inspection/check commands, secret import, and a daemon management CLI.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.35.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.35.0

     └──▷ TRY IT
     Before running an agent task, verify that the current policy permits a specific outbound connection — catch misconfigurations without launching the full sandbox.
     copy

     $ sbx policy check network --host api.example.com --port 443

     Route all sandbox egress through a corporate SOCKS5 proxy (with credentials) so sandbox traffic flows through your org's inspection infrastructure.
     copy

     $ DOCKER_SANDBOXES_PROXY=socks5://proxyuser:proxypass@proxy.corp.example.com:1080 DOCKER_SANDBOXES_NO_PROXY=localhost,127.0.0.1 sbx run

     Migrate host env-var credentials (e.g. API keys) into the keychain so they are explicitly managed rather than auto-injected at runtime.
     copy

     $ sbx secret import

     • Adds SOCKS5 upstream-proxy transport (socks5:// / socks5h://) for sandbox egress via DOCKER_SANDBOXES_PROXY, HTTP_PROXY, or HTTPS_PROXY, with optional auth and DOCKER_SANDBOXES_NO_PROXY exclusions.
     • New sbx policy inspect command to examine policy details.
     • New sbx policy check network command to test whether the current policy would allow a network access request before executing.
     • Revamped sbx policy ls with --wide, --source, and --decision filters for concise policy listing.
     • New sbx secret import imports credential env vars into the keychain; sbx secret ls now flags env-only and OAuth-shadowed entries. Host env vars no longer auto-inject at runtime — migration required.

     +10 more show less

     • New sbx daemon command with start, stop, status, and log-level subcommands for daemon lifecycle management.
     • sbx inspect now surfaces the sandbox's kits, injected secrets, and sandbox information.
     • sbx rm now requires --force to delete an active session, preventing accidental teardown.
     • sbx kit add now recreates the sandbox container with the full kit set (preserving state) and applies the kit's network allow/deny rules and composed policy.
     • Kits can inject the user's Docker login token into requests to docker.com hosts via a credential with service sbx-login.
     • Re-attaching to a sandbox created with a custom --kit agent now works via sbx run --name <name> without re-passing --kit.
     • Enables virtiofs caching by default on all operating systems for faster filesystem performance (opt out with DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=0).
     • Balanced network preset now allows VS Code domains, Azure Blob Storage (*.blob.core.windows.net), and dhi.io over HTTP.
     • Droid OAuth credentials are now proxy-managed, keeping real tokens on the host and out of the sandbox.
     • Faster sandbox startup via optimized TLS-proxy CA installation (merging into trust bundle instead of running update-ca-certificates), saving several hundred milliseconds.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Host env vars no longer auto-inject at runtime — use sbx secret import to migrate existing env-var-based secrets.
     • !sbx rm now won't delete an active session unless --force is passed.
     • !Installation is blocked on Windows versions older than Windows 11.
102. v0.34.0 Jun 26, 2026 · release notes

     Docker Sandboxes v0.34.0 adds a native SSH endpoint, sbx setup onboarding command, and OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. v2 kit streaming.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.34.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.34.0

     └──▷ TRY IT
     Connect to a running sandbox over SSH for an interactive shell without needing a separate tunnel.
     copy

     $ sbx settings set feature.ssh true && ssh my-sandbox@127.0.0.1 -p 2222

     Allow kit installs from a private registry in addition to Docker Hub.
     copy

     $ sbx settings set kit.allowedSources docker.io/,registry.example.com/

     Bootstrap agent credentials on a new machine using environment variables.
     copy

     $ sbx setup

     • Adds experimental native SSH endpoint in sandboxd: connect with ssh <sandbox-name>@127.0.0.1 -p 2222 (publickey auth, connect-to-create, interactive shell and exec), enabled via sbx settings set feature.ssh true.
     • Adds experimental sbx setup command that imports agent credentials from environment variables for smoother first-time onboarding.
     • Adds OCI v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory usage between reads.
     • Restricts kit installs to an allowlist of sources (defaulting to Docker Hub docker.io/ only), configurable via sbx settings set kit.allowedSources.
     • Restores published sandbox ports on restart, with CLI/TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. able to recover explicit host-port conflicts by selecting a new host port.

     5 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Installing a kit from a registry other than docker.io/ or from a Git URL now fails until you add its prefix with sbx settings set kit.allowedSources.
     • !sbx policy set-default is renamed to sbx policy init; the old name remains as a hidden, deprecated alias.
103. v0.34.0 Jun 26, 2026 · issue 012

     Docker Sandboxes v0.34.0 adds a native SSH endpoint, kit source allowlisting, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. v2 streaming, and a new onboarding command.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.34.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.34.0

     └──▷ TRY IT
     Enable the experimental SSH endpoint so agents or operators can shell directly into a running sandbox without a separate proxy.
     copy

     $ sbx settings set feature.ssh true

     Connect an interactive shell to a named sandbox over the native SSH endpoint once feature.ssh is enabled.
     copy

     $ ssh <sandbox-name>@127.0.0.1 -p 2222

     Allow kit installs from a private registry or Git source in addition to Docker Hub, to avoid the new allowlist breaking change.
     copy

     $ sbx settings set kit.allowedSources ghcr.io/myorg/

     • New experimental native SSH endpoint in sandboxd: connect with ssh <sandbox-name>@127.0.0.1 -p 2222 (publickey auth, connect-to-create, interactive shell and exec).
     • New experimental sbx setup command imports agent credentials from environment variables for smoother first-time onboarding.
     • Adds OCI v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory pressure during kit reads.
     • Restricts kit installs to an allowlist of sources (default: Docker Hub only); installing from other registries or Git URLs now fails unless explicitly permitted — breaking change.
     • Renames sbx policy set-default to sbx policy init; old name kept as a hidden deprecated alias.

     +1 more show less

     • Restores published sandbox ports on restart, with automatic recovery from host-port conflicts by selecting a new host port.

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Kit installs are restricted to an allowlist of sources defaulting to Docker Hub (docker.io/) only; installing a kit from another registry or a Git URL fails until you add its prefix with sbx settings set kit.allowedSources.
     • !The sbx policy set-default command is renamed to sbx policy init (the old name still works as a hidden deprecated alias, but is deprecated).
104. v0.34.0 Jun 26, 2026 · issue 003

     Docker Sandboxes v0.34.0 adds a native SSH endpoint, kit source allowlisting, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. v2 streaming, and a new onboarding command.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.34.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.34.0

     └──▷ TRY IT
     Enable the experimental SSH endpoint so agents or operators can shell directly into a running sandbox without a separate proxy.
     copy

     $ sbx settings set feature.ssh true

     Connect an interactive shell to a named sandbox over the native SSH endpoint once feature.ssh is enabled.
     copy

     $ ssh <sandbox-name>@127.0.0.1 -p 2222

     Allow kit installs from a private registry or Git source in addition to Docker Hub, to avoid the new allowlist breaking change.
     copy

     $ sbx settings set kit.allowedSources ghcr.io/myorg/

     • New experimental native SSH endpoint in sandboxd: connect with ssh <sandbox-name>@127.0.0.1 -p 2222 (publickey auth, connect-to-create, interactive shell and exec).
     • New experimental sbx setup command imports agent credentials from environment variables for smoother first-time onboarding.
     • Adds OCI v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory pressure during kit reads.
     • Restricts kit installs to an allowlist of sources (default: Docker Hub only); installing from other registries or Git URLs now fails unless explicitly permitted — breaking change.
     • Renames sbx policy set-default to sbx policy init; old name kept as a hidden deprecated alias.

     +1 more show less

     • Restores published sandbox ports on restart, with automatic recovery from host-port conflicts by selecting a new host port.

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Kit installs are restricted to an allowlist of sources defaulting to Docker Hub (docker.io/) only; installing a kit from another registry or a Git URL fails until you add its prefix with sbx settings set kit.allowedSources.
     • !The sbx policy set-default command is renamed to sbx policy init (the old name still works as a hidden deprecated alias, but is deprecated).
105. v0.34.0 Jun 26, 2026 · issue 002

     Docker Sandboxes v0.34.0 adds a native SSH endpoint, kit source allowlisting, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. v2 streaming, and a new onboarding command.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.34.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.34.0

     └──▷ TRY IT
     Enable the experimental SSH endpoint so agents or operators can shell directly into a running sandbox without a separate proxy.
     copy

     $ sbx settings set feature.ssh true

     Connect an interactive shell to a named sandbox over the native SSH endpoint once feature.ssh is enabled.
     copy

     $ ssh <sandbox-name>@127.0.0.1 -p 2222

     Allow kit installs from a private registry or Git source in addition to Docker Hub, to avoid the new allowlist breaking change.
     copy

     $ sbx settings set kit.allowedSources ghcr.io/myorg/

     • New experimental native SSH endpoint in sandboxd: connect with ssh <sandbox-name>@127.0.0.1 -p 2222 (publickey auth, connect-to-create, interactive shell and exec).
     • New experimental sbx setup command imports agent credentials from environment variables for smoother first-time onboarding.
     • Adds OCI v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory pressure during kit reads.
     • Restricts kit installs to an allowlist of sources (default: Docker Hub only); installing from other registries or Git URLs now fails unless explicitly permitted — breaking change.
     • Renames sbx policy set-default to sbx policy init; old name kept as a hidden deprecated alias.

     +1 more show less

     • Restores published sandbox ports on restart, with automatic recovery from host-port conflicts by selecting a new host port.

     6 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !Kit installs are restricted to an allowlist of sources defaulting to Docker Hub (docker.io/) only; installing a kit from another registry or a Git URL fails until you add its prefix with sbx settings set kit.allowedSources.
     • !The sbx policy set-default command is renamed to sbx policy init (the old name still works as a hidden deprecated alias, but is deprecated).
106. v0.33.0 Jun 17, 2026 · release notes

     sbx v0.33.0 adds named sandbox identities, DNS-gated network policy, wildcard secrets, and virtiofs caching by default.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.33.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.33.0

     └──▷ TRY IT
     Run two independent sandboxes for the same agent in the same workspace, then re-attach to one by name from any directory.
     copy

     $ sbx run --name pentest-alpha claude
     sbx run --name pentest-beta claude
     # Later, from any directory:
     sbx run --name pentest-alpha

     Allow a custom secret to cover an entire subdomain wildcard so one secret serves all regional API endpoints.
     copy

     $ sbx secret set-custom --host '*.api.example.com' --host '**.internal.corp' MY_API_TOKEN

     Allow a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. subnet in sandbox network policy, then confirm the stable sandbox ID is present in JSON output.
     copy

     $ sbx policy allow network 10.10.14.0/24
     sbx ls --json | jq '.[].id'

     • New --name flag for sbx run identifies a sandbox independent of working directory, enabling multiple named sandboxes per workspace and re-attachment from any directory.
     • sbx ls --json now reports a stable per-sandbox id field.
     • sbx cp -L now follows symlinks in the source path for sandbox-to-host copies.
     • Sandbox DNS lookups are now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039); loopback names remain exempt.
     • Outgoing ICMP from sandboxes is now blocked across daemon restarts (CVE-2026-12539).

     +8 more show less

     • MITM proxy now publishes a CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. and embeds a CRL distribution point in generated certificates, enabling revocation-strict clients (e.g. .NET) to work inside sandboxes.
     • sbx secret set-custom --host and serviceDomains in kits now accept wildcard host patterns (* for one label, ** for any number) and are repeatable to cover multiple subdomains/domains.
     • Cursor OAuth is now supported as an agent.
     • virtiofs cache is now enabled by default on macOS and Linux for improved filesystem performance.
     • Build packages for linux/arm64 are now produced.
     • Linux keychain backend now falls back to the encrypted on-disk store when dbus-launch is unavailable, supporting headless/server hosts.
     • Claude connectors (Slack, Gmail, Notion, Atlassian, etc.) now work inside sandboxed Claude Code without manual policy overrides.
     • Daemon inspect output is now included in the diagnostics bundle.

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The positional argument to sbx run <sandbox> for re-attaching to an existing sandbox is deprecated and will be removed in a future release; use sbx run --name <sandbox> instead (a deprecation warning is printed now).
     • !sbx run --name no longer auto-creates numbered sibling sandboxes and errors when the requested agent doesn't match the named sandbox.
     • !Sandbox DNS resolution is now blocked for domains denied by network policy, which may break sandboxed processes that previously resolved policy-denied domains.
107. v0.33.0 Jun 17, 2026 · issue 012

     sbx v0.33.0 adds named sandbox identity, DNS-gated network policy, wildcard secrets, and Cursor OAuth support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.33.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.33.0

     └──▷ TRY IT
     Run two independent Claude Code sandboxes in the same workspace — useful when parallelising agent tasks without them colliding.
     copy

     $ sbx run --name feature-a claude && sbx run --name feature-b claude

     Re-attach to a named sandbox from a different directory without specifying an agent, useful when returning to a long-running session.
     copy

     $ sbx run --name feature-a

     Grant a custom secret to all subdomains of an internal service using wildcard host patterns.
     copy

     $ sbx secret set-custom --host '*.internal.corp' --host '**.api.internal.corp' MY_API_TOKEN

     • New --name flag for sbx run identifies a sandbox independently of the working directory, enabling multiple named sandboxes in the same workspace and re-attachment from any directory.
     • sbx ls --json now reports a stable per-sandbox id field for scripting and automation.
     • Sandbox DNS resolution is now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039); loopback names remain exempt.
     • Outgoing ICMP from sandboxes is now blocked persistently across daemon restarts (CVE-2026-12539).
     • sbx secret set-custom --host and serviceDomains in kits now accept wildcard host patterns (* for one label, ** for any number) and are repeatable, allowing one secret to cover multiple subdomains.

     +8 more show less

     • Adds Cursor OAuth support as a recognized agent.
     • virtiofs cache is now enabled by default on macOS and Linux, improving filesystem performance.
     • Linux arm64 build packages are now produced, extending platform support.
     • New keychain fallback to encrypted on-disk store on Linux when dbus-launch is unavailable, enabling headless/server deployments.
     • MITM proxy now publishes a CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. and embeds a CRL distribution point in generated certificates, supporting revocation-strict TLS clients (e.g., .NET).
     • Claude connectors (Slack, Gmail, Notion, Atlassian, etc.) now work inside sandboxed Claude Code without manual policy overrides.
     • sbx cp -L now follows symlinks in the source path for sandbox-to-host copies.
     • sbx exec now uses the same working directory as sbx run.

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The sbx run <name> positional argument form for re-attaching to an existing sandbox now prints a deprecation warning; the positional argument for sbx run is expected to be an agent (e.g. claude, codex), not a sandbox name, and the old positional-name form will be removed in a future release.
     • !sbx run --name no longer auto-creates numbered sibling sandboxes when a same-named sandbox exists.
     • !sbx create now errors when run without arguments instead of proceeding.
108. v0.33.0 Jun 17, 2026 · issue 003

     sbx v0.33.0 adds named sandbox identity, DNS-gated network policy, wildcard secrets, and Cursor OAuth support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.33.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.33.0

     └──▷ TRY IT
     Run two independent Claude Code sandboxes in the same workspace — useful when parallelising agent tasks without them colliding.
     copy

     $ sbx run --name feature-a claude && sbx run --name feature-b claude

     Re-attach to a named sandbox from a different directory without specifying an agent, useful when returning to a long-running session.
     copy

     $ sbx run --name feature-a

     Grant a custom secret to all subdomains of an internal service using wildcard host patterns.
     copy

     $ sbx secret set-custom --host '*.internal.corp' --host '**.api.internal.corp' MY_API_TOKEN

     • New --name flag for sbx run identifies a sandbox independently of the working directory, enabling multiple named sandboxes in the same workspace and re-attachment from any directory.
     • sbx ls --json now reports a stable per-sandbox id field for scripting and automation.
     • Sandbox DNS resolution is now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039); loopback names remain exempt.
     • Outgoing ICMP from sandboxes is now blocked persistently across daemon restarts (CVE-2026-12539).
     • sbx secret set-custom --host and serviceDomains in kits now accept wildcard host patterns (* for one label, ** for any number) and are repeatable, allowing one secret to cover multiple subdomains.

     +8 more show less

     • Adds Cursor OAuth support as a recognized agent.
     • virtiofs cache is now enabled by default on macOS and Linux, improving filesystem performance.
     • Linux arm64 build packages are now produced, extending platform support.
     • New keychain fallback to encrypted on-disk store on Linux when dbus-launch is unavailable, enabling headless/server deployments.
     • MITM proxy now publishes a CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. and embeds a CRL distribution point in generated certificates, supporting revocation-strict TLS clients (e.g., .NET).
     • Claude connectors (Slack, Gmail, Notion, Atlassian, etc.) now work inside sandboxed Claude Code without manual policy overrides.
     • sbx cp -L now follows symlinks in the source path for sandbox-to-host copies.
     • sbx exec now uses the same working directory as sbx run.

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The sbx run <name> positional argument form for re-attaching to an existing sandbox now prints a deprecation warning; the positional argument for sbx run is expected to be an agent (e.g. claude, codex), not a sandbox name, and the old positional-name form will be removed in a future release.
     • !sbx run --name no longer auto-creates numbered sibling sandboxes when a same-named sandbox exists.
     • !sbx create now errors when run without arguments instead of proceeding.
109. v0.33.0 Jun 17, 2026 · issue 002

     sbx v0.33.0 adds named sandbox identity, DNS-gated network policy, wildcard secrets, and Cursor OAuth support.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.33.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.33.0

     └──▷ TRY IT
     Run two independent Claude Code sandboxes in the same workspace — useful when parallelising agent tasks without them colliding.
     copy

     $ sbx run --name feature-a claude && sbx run --name feature-b claude

     Re-attach to a named sandbox from a different directory without specifying an agent, useful when returning to a long-running session.
     copy

     $ sbx run --name feature-a

     Grant a custom secret to all subdomains of an internal service using wildcard host patterns.
     copy

     $ sbx secret set-custom --host '*.internal.corp' --host '**.api.internal.corp' MY_API_TOKEN

     • New --name flag for sbx run identifies a sandbox independently of the working directory, enabling multiple named sandboxes in the same workspace and re-attachment from any directory.
     • sbx ls --json now reports a stable per-sandbox id field for scripting and automation.
     • Sandbox DNS resolution is now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039); loopback names remain exempt.
     • Outgoing ICMP from sandboxes is now blocked persistently across daemon restarts (CVE-2026-12539).
     • sbx secret set-custom --host and serviceDomains in kits now accept wildcard host patterns (* for one label, ** for any number) and are repeatable, allowing one secret to cover multiple subdomains.

     +8 more show less

     • Adds Cursor OAuth support as a recognized agent.
     • virtiofs cache is now enabled by default on macOS and Linux, improving filesystem performance.
     • Linux arm64 build packages are now produced, extending platform support.
     • New keychain fallback to encrypted on-disk store on Linux when dbus-launch is unavailable, enabling headless/server deployments.
     • MITM proxy now publishes a CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live. and embeds a CRL distribution point in generated certificates, supporting revocation-strict TLS clients (e.g., .NET).
     • Claude connectors (Slack, Gmail, Notion, Atlassian, etc.) now work inside sandboxed Claude Code without manual policy overrides.
     • sbx cp -L now follows symlinks in the source path for sandbox-to-host copies.
     • sbx exec now uses the same working directory as sbx run.

     13 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The sbx run <name> positional argument form for re-attaching to an existing sandbox now prints a deprecation warning; the positional argument for sbx run is expected to be an agent (e.g. claude, codex), not a sandbox name, and the old positional-name form will be removed in a future release.
     • !sbx run --name no longer auto-creates numbered sibling sandboxes when a same-named sandbox exists.
     • !sbx create now errors when run without arguments instead of proceeding.
110. v0.32.0 Jun 9, 2026 · release notes

     Docker Sandboxes v0.32.0 adds audit logging, sign-in enforcement, OpenRouterOpenRouterA unified API gateway that routes requests to dozens of LLM providers under one endpoint, letting cyber tools swap or compare models without rewriting provider-specific integration code. secrets, OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. v2 kit support, and unhides custom secrets.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.32.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.32.0

     └──▷ TRY IT
     Set an OpenRouter API key as a built-in secret so the proxy automatically injects the Authorization header for all agent requests.
     copy

     $ sbx secret set my-sandbox openrouter

     Review active network policy rules for a sandbox and reveal hidden inactive governed rules for compliance auditing.
     copy

     $ sbx policy ls --include-inactive

     • New audit logging emits structured JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. records for every policy decision, written to a per-OS log directory and forwardable to any SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. for enterprise compliance (requires Docker AI Governance subscription).
     • New sign-in enforcement lets admins require Docker organization membership verification, deployed via macOS configuration profiles, the Windows registry, or a JSON policy file on Linux.
     • Adds interactive Sign in with ChatGPT OAuth flow on first sbx create/sbx run codex when no Codex credentials are configured.
     • Makes global the default scope for policy network allow|deny and policy rm; adds --sandbox flag to target a specific sandbox (drops the -g/--global flag).
     • Unhides sbx secret set-custom as an experimental command for setting custom secrets.

     +7 more show less

     • Adds OpenRouter as a built-in service provider so sbx secret set <sandbox> openrouter works without set-custom, with automatic Authorization: Bearer <token> injection.
     • Adds encrypted on-disk secrets store fallback on Linux/WSLWSLWindows Subsystem for Linux, a Microsoft-built compatibility layer that lets a Linux environment run directly on Windows without a virtual machine, giving cyber tools access to Linux binaries, filesystems, and syscalls on a Windows host. hosts where no working keychain is available.
     • Supports custom-secret sentinel substitution inside HTTP Basic auth payloads.
     • Hides inactive governed policy rules by default in sbx policy ls and the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. Network Rules view; adds --include-inactive flag (TUI i toggle) to reveal them.
     • Supports v2 OCI kit artifact format end-to-end, making kits standard OCI images inspectable by Hub, oras, crane, and skopeo without kit-specific knowledge.
     • Simplifies sbx version to a single line by default; gates detailed output behind -D/--debug.
     • Keeps virtiofs caching enabled for sandboxes using --clone, speeding up git status, grep -r, and tree walks by avoiding a FUSEFUSEA Linux kernel interface that lets userspace programs implement a filesystem without kernel code, maintained as part of the kernel project; tools use it to mount virtual or synthetic filesystems without requiring root or kernel modules. round-trip on every stat().

     12 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The -g/--global flag is removed from policy network allow|deny and policy rm; global is now the default scope and --sandbox targets a specific sandbox instead.
111. v0.31.0 May 28, 2026 · release notes

     Docker Sandboxes v0.31.0 adds clone-mode sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls., private registry secrets, and policy filters.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.31.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.31.0

     └──▷ TRY IT
     Run a sandbox in clone mode so the agent writes only to an in-container copy, leaving your working tree and .git/ untouched.
     copy

     $ sbx run claude --clone

     Store GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository. pull credentials host-side so sbx run --template and sbx run --kit can pull from a private registry without docker login.
     copy

     $ sbx secret set --registry ghcr.io

     After removing a sandbox, recover a branch from the persisted sandbox refs.
     copy

     $ git branch my-feature refs/sandboxes/<name>/my-feature

     • New --clone flag replaces --branch: sandboxes now run against an in-container read-only clone, keeping writes out of your host working tree and .git/
     • Host source repository is mounted read-only into the sandbox, with a shallow in-container clone; forge remotes (origin, upstream, etc.) are propagated so the agent can git push directly
     • Sandbox refs are mirrored to refs/sandboxes/<name>/* on the host and persist after the sandbox is removed, enabling branch recovery with git branch
     • Adds sbx secret set --registry to store container-registry pull credentials for pulling from private registries (GHCR, ACR, ECRECRAmazon Elastic Container Registry, AWS's managed service for storing and distributing Docker and OCI container images, giving cyber tools a private, IAM-gated registry without self-hosting infrastructure., Quay, etc.) without docker login
     • Manage registry credentials with sbx secret ls and remove them with sbx secret rm --registry <host>

     +6 more show less

     • sbx create now auto-starts the daemon when it isn't running
     • Opt a sandbox into virtiofs caching at create time via DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=1; the setting is persisted in the spec across daemon restarts
     • Policy and rule names are now shown in CLI list output and TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. details
     • Adds filters to the policies listing
     • Verbose error reporting for kit apply failures
     • Allows public-CA CRLCRLA Certificate Revocation List is a signed file, published by a certificate authority, listing certificates it has revoked before expiry so that clients can reject compromised or mis-issued credentials without contacting the CA live./OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists./AIA endpoints in the balanced proxy preset

     11 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The --branch flag has been removed; using --branch now fails with an error. Replace all uses of --branch with --clone.
     • !The balanced proxy preset change (allowing public-CA CRL/OCSP/AIA endpoints) applies only to new installations or after running sbx policy reset, which removes any user-added rules.
112. v0.30.0 May 19, 2026 · release notes

     Docker Sandboxes v0.30.0 adds non-interactive Hub login, configurable auto-stop grace periods, and policy setup before login.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.30.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.30.0

     • Adds non-interactive Docker Hub login to support scripted and CI/CD workflows.
     • Adds configurable grace period before a sandbox auto-stops when the last session exits.
     • Allows sbx policy setup to run before login, enabling pre-auth governance configuration.
     • Re-runs commands.startup on every container start, making init hooks idempotent across restarts.
     • Adds per-kit memory files for progressive disclosure of kit context to AI agents.

     +4 more show less

     • Enumerates installed kits in the AI memory file's Kits section.
     • Migrates /reset endpoint to /daemon/reset with state-dir wipe now handled daemon-side.
     • Binds both loopback stacks (IPv4 and IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.) by default when publishing ports.
     • Allows raw TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. to host.docker.internal when localhost is permitted in policy.

     9 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The /reset endpoint is replaced by /daemon/reset; any script or tooling calling /reset directly will need to be updated.
113. v0.29.0 May 13, 2026 · release notes

     Docker Sandboxes v0.29.0 adds per-sandbox network policies, daemon-assigned UUIDsUUIDsA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide., and a confirmation gate on sbx rm.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.29.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.29.0

     └──▷ TRY IT
     Remove a named sandbox interactively — the new confirmation prompt stops accidental deletion in scripts without -y.
     copy

     $ sbx rm my-sandbox

     • Supports per-sandbox scoped network policies for fine-grained egress control per sandbox instance.
     • Adds deniedDomains field to network kit policy to explicitly block specific domains.
     • Allows binary TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it. protocols (e.g. SSH) through domain allow rules in network policy.
     • Adds daemon-assigned UUIDs to sandbox runtimes for reliable identification across restarts and telemetry.
     • Enables SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. browser relay for Gemini agent.

     +3 more show less

     • Auto-opens browser during OpenAI OAuth flow.
     • Exposes Claude guidance to Codex sandboxes.
     • Unhides kit command in help output, making it discoverable via sbx --help.

     8 details in Everything

114. v0.28.2 Apr 29, 2026 · release notes

     Docker Sandboxes v0.28.2 auto-opens the browser on login and adds SSH client tools to the main template.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.28.2 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.28.2

     • Adds auto-open browser during the login flow, removing the need to manually copy-paste a URL.
     • Installs ssh-add and SSH client tools in the main template, enabling SSH agent and key operations out of the box.

     2 details in Everything

115. v0.28.1 Apr 28, 2026 · release notes

     Docker Sandboxes v0.28.1 adds --kit for custom agent kits and in-process sandbox run/exec with launch/settings dialogs in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.28.1 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.28.1

     • Adds --kit flag to invoke custom agent kits from the CLI, now surfaced in --help.
     • Enables in-process sandbox run/exec with a launch mode dialog and settings dialog in the TUI.

     2 details in Everything

116. v0.27.0 Apr 20, 2026 · release notes

     Docker Sandboxes v0.27.0 adds Linux TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. support, governance visibility in sbx policy ls, and renames the Factory-ai agent to droid.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.27.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.27.0

     └──▷ TRY IT
     Check which organization's policy is active and whether it's in sync with the remote before running sandbox workloads.
     copy

     $ sbx policy ls

     • Supports Linux terminal spawning in the TUI across kitty, wezterm, alacritty, ghostty, gnome-terminal, konsole, xfce4-terminal, and xterm.
     • Surfaces active organization name and remote sync status in sbx policy ls output and the TUI governance tab.
     • Renames the Factory-ai agent to droid.
     • Adds support for removing template images by image ID in addition to tags.

     4 details in Everything

117. v0.26.1 Apr 17, 2026 · release notes

     Docker Sandboxes v0.26.1 adds sbx diagnose, template management commands, Factory.ai support, and OAuth redirect handling inside sandboxes.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.26.1 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.26.1

     └──▷ TRY IT
     Collect and upload diagnostics when filing a bug report or troubleshooting a broken sandbox.
     copy

     $ sbx diagnose

     Snapshot the current sandbox state as a reusable template, then list and restore it later.
     copy

     $ sbx template save my-baseline
     sbx template ls
     sbx template load my-baseline

     • New sbx diagnose command collects and uploads diagnostic data for troubleshooting sandbox issues.
     • New sbx template save, load, ls, and rm commands for managing sandbox templates.
     • Warns when loading a template built for a different agent.
     • Adds Factory.ai as a supported agent with a dedicated template.
     • Adds xdg-open shim and localhost OAuth callback so browser-based auth redirects work inside sandboxes.

     +3 more show less

     • Daemon now supports log rotation for daemon logs.
     • Adds downloads.claude.ai and claude.com to Claude's proxy allow list.
     • Adds **.hashicorp.com to the default proxy allow list.

     8 details in Everything

118. v0.25.0 Apr 13, 2026 · release notes

     Docker Sandboxes v0.25.0 adds upstream proxy support, --cpus allocation control, and PID-based daemon recovery.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.25.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.25.0

     └──▷ TRY IT
     Cap CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. usage for a sandbox to prevent noisy-neighbor issues in shared environments.
     copy

     $ sbx run --cpus 2 <agent>

     • Adds --cpus flag to create and run commands for controlling sandbox CPU allocation.
     • Adds upstream proxy support for routing sandbox traffic through corporate proxies.
     • Adds PID file fallback for sbx daemon stop when the daemon socket is unresponsive, with platform-specific identity verification.
     • Adds apt and dnf update prompts for Linux installations.
     • Expands OAuth secret ls/rm handling for Anthropic.

     +5 more show less

     • Adds daemon OAuth reload endpoint and hardens Codex token sync.
     • Shows rule origin and status for policykit rules.
     • Returns non-zero exit code when user cancels prompts.
     • Fails daemon startup if mount policy engine cannot be created (explicit startup enforcement).
     • Skips mount policy eviction when default rules are not set.

     10 details in Everything

119. v0.24.2 Apr 8, 2026 · release notes

     Docker Sandboxes v0.24.2 adds a sandbox info dialog, improved TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. notifications, and better daemon error visibility.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.24.2 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.24.2

     • Adds sandbox info dialog for viewing details of a running sandbox directly in the TUI.
     • Displays explanatory action messaging when creating a new sandbox.
     • Improves TUI notification system with updated styling and behavior.
     • Shows an error in the TUI when the daemon becomes unreachable.
     • Bypasses login check and network policy setup when running the reset operation.

     5 details in Everything

120. v0.24.1 Apr 6, 2026 · release notes

     Docker Sandboxes v0.24.1 adds button-style confirmation dialogs, horizontal scrolling for long hostnames, and Ubuntu 25.10/26.04 packages.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.24.1 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.24.1

     • Adds button-style confirmation dialogs with full mouse click support and keyboard navigation in the TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency..
     • Adds horizontal scrolling for long hostnames and rule values in expanded network detail views.
     • Adds deb package builds for Ubuntu 25.10 and 26.04.

     3 details in Everything

121. v0.23.0 Apr 2, 2026 · release notes

     Docker Sandboxes v0.23.0 adds OpenAI OAuth for Codex and auto-stop on agent disconnect.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.23.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.23.0

     └──▷ TRY IT
     Authenticate a Codex sandbox via OAuth instead of providing an API key — useful in environments where interactive browser-based login is preferred.
     copy

     $ docker sbx run --oauth-login codex

     • Adds OpenAI OAuth authentication flow for Codex sandboxes via --oauth-login flag on create/run commands, replacing API key requirement.
     • Enables automatic session termination when all agents and exec sessions disconnect, using reference counting (detached sandboxes are unaffected).

     2 details in Everything

122. v0.21.0 Mar 31, 2026 · release notes

     Docker Sandboxes v0.21.0 adds network policy controls, rm --all, multi-worktree --branch flag, and standalone Linux binary.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.21.0 https://github.com/docker/sbx-releases.git
     # already have the repo? check out this version:
     $ git checkout v0.21.0

     └──▷ TRY IT
     Tear down every sandbox at once during CI cleanup or a fresh-start workflow.
     copy

     $ sbx rm --all

     Restore the default network policy for a sandbox after ad-hoc rule changes.
     copy

     $ sbx policy reset

     • New policy reset command restores default network policies for a sandbox.
     • Adds default network policy selection during sandbox creation.
     • Deduplicates network domain rules so one rule is created per domain.
     • New rm --all flag removes all sandboxes in a single command.
     • New --branch flag enables multiple worktrees inside one sandbox, using the branch name as the worktree path.

     +10 more show less

     • Adds --preserve-credentials / --preserve-secrets flag to reset for retaining secrets across resets.
     • Returns exit code 127 when a binary is missing in sbx exec, matching POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems. convention.
     • Handles Ctrl+Z to suspend the sbx process.
     • Supports configurable Docker volume size via environment variable for Docker-in-Docker (DinD).
     • Exposes internal error details in API error responses.
     • Supports dots in sandbox names by sanitizing Docker network names.
     • Adds Generic OAuth support for blueprint agents.
     • TUITUIA text-based user interface that runs inside a terminal, using characters and ANSI escape codes to render menus, panes, and widgets without a graphical desktop, letting cyber tools ship rich interactivity with no GUI dependency. gains reusable dialog open/close/resize animations and improved Warp terminal support.
     • Linux packaging now available as a standalone binary.
     • Points SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, and REQUESTS_CA_BUNDLE at the full CA bundle.

     15 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The reset flag --preserve-credentials is renamed to --preserve-secrets.