Docker Sandboxes — The Cyber Toolchain

Docker Sandboxes v0.51.0

Tue, 03 Nov 2026 14:06:45 GMT

Docker Sandboxes adds custom mount targets, FUSE filesystem support, stdin secret input, and new policy and MCP controls in v0.51.0⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Mount additional workspaces at custom paths by passing `PATH:TARGET[:ro]` to `sbx create` and `sbx run`, or setting `additionalWorkspaces[].target` in environment files.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Start agents in a subdirectory with `sbx run --workdir`, including when reattaching to an existing sandbox. • Suppress creation progress output with `sbx run --no-progress` while still receiving command results, or use `sbx create --no-progress` for creation. • Read secrets from standard input with `sbx secret set-custom --value-stdin`, keeping secret values out of command arguments. • Enable FUSE filesystems in local sandboxes via the `sandbox.fuse` setting or the environment option `sandboxOptions.fuse`. • Check HTTP governance policy behavior with the new `sbx policy check http` command. • Disable local CLI and daemon telemetry persistently with `sbx settings set telemetry.disabled true`; run `sbx daemon restart` to apply to a running daemon. • Prefix MCP tool names with their server name by enabling `mcp.useServerNamePrefixes`. • Use static MCP mode without attaching servers by passing `--static-mcp none` to `sbx create` or `sbx run`. • Disable the bundled model server and its inference-runtime download by setting `model.server.enabled` to `false` and running `sbx daemon restart`. Breaking changes: • Built-in agent names now resolve to published kits at `docker.io/sbx/:latest`; the `kit.allowExtractedAgents` setting is removed. • Sandboxes created from embedded Claude or Codex specifications must be recreated before using `sbx kit add`, `sbx run --model`, or `sbx move` — save files and unpushed commits before removing. • The shell agent now uses a published Debian 13 v3 kit and requires registry access on first use; add the `shell-credentials` mixin to provide provider credentials. • V1 and v2 kits cannot be combined with v3 kits — older mixins must be upgraded to v3 before combining with the new built-in kits. • The `docker/sandbox-templates` images for `codex`, `cursor-agent`, `devin`, `docker-agent`, and `opencode` (including `-docker` variants) are no longer published. • The `docker/sandbox-templates:shell` and `:shell-docker` images are no longer refreshed; use `docker.io/sbx/shell-image` and `docker.io/sbx/shell-docker-image` for custom workloads. • Copying text from a local sandbox to the host clipboard now requires opting in with the `clipboard.textCopy` setting. • Custom secrets without destination hosts no longer substitute credentials — existing mappings must be repaired by adding explicit destination hosts while preserving their placeholders and other settings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.50.0

Mon, 26 Oct 2026 14:44:45 GMT

Docker Sandboxes v0.50.0 adds cloud sandbox inspection, configurable kit host mounts, persistent kit volumes, and HTTP query-parameter network rules.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sbx --cloud inspect ` to show details for a single cloud sandbox, including published port URLs; supports `--format json` and `--format yaml` for scripting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--mount HOST:SANDBOX_PATH` flag to `sbx create` and `sbx run` for selecting a host directory for a kit-declared host mount; environment files support the same bindings through `mounts`. • Adds `--query name=value` flag (repeatable) to HTTP network rules to require specific query-parameter restrictions. • Adds `--skip-host-commands` flag to disable Environment MCP host-execution commands for a sandbox. • Persistent kit volumes now retain data across kit updates and sandbox removal and recreation with the same name. • `sbx exec` now returns exit status 125 when it cannot run the command (e.g. sandbox does not exist). • `sbx cp` rejects symbolic links that escape a sandbox workspace when reached through an alternate host path, including a symlink, junction, macOS `/private/tmp`, or a Linux bind mount of a workspace subdirectory. • Sandboxes created with `--clone` now preserve kit-provided workspace files and report clone initialization failures. • On macOS and Windows, `sbx diagnose` and daemon logs warn when `SSL_CERT_FILE` or `SSL_CERT_DIR` replaces the system trust store. • Gordon clears 'Approve all' and 'Always allow' grants when a conversation resumes, requiring fresh approval before running tools again. Breaking changes: • Windows: older elevated daemons must be stopped with the previous CLI or Task Manager before using the updated CLI, because the updated CLI verifies that the daemon's named pipes belong to the same Windows user. • Each local source kit rebuilds once after upgrading, because local source kits are now reused only when their digests match recorded local builds. • Existing sandbox records retain their previous storage behavior — persistent kit volumes only apply to sandboxes created with v0.50.0 or later. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.49.1

Tue, 20 Oct 2026 08:54:23 GMT

Docker Sandboxes v0.49.1 adds offline kit validation, proxy-aware cloud commands, richer CLI diagnostics, and new daemon log settings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • `sbx kit validate` and `sbx kit inspect` now accept `--offline` to check a local directory or ZIP kit without starting the daemon or signing in; sandboxes created from local or Git v3 kits now honor build-time `--kit-arg` values, including scoped overrides; `sbx kit sign` warns when Git would change the signed file contents and invalidate signatures for `git+` references; and `sbx settings set` rejects incorrectly structured values for `kit.allowedSources` and `kit.trustedSigners` before saving them.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `daemon.log.maxSizeMB`, `daemon.log.maxBackups`, and `daemon.log.maxAgeDays` keys to `sbx settings set` for controlling daemon log size and retention, the `browser.enabled` setting to control whether sandboxes can open the host browser, and the `proxy.sshDirect` setting (set to `true`) to connect cloud SSH directly on networks that permit direct SSH connections. • `sbx policy ls`, `sbx settings ls`, and `sbx policy approval ls` now accept `-q` to print only rule IDs, setting keys, or approval IDs. • `sbx policy refresh` immediately refreshes policy instead of waiting for the next polling interval. • `sbx secret rm` now returns an error when no secret matches `--registry`, `--placeholder`, `--host`, or `--env-name`, and `sbx secret set-custom` warns before replacing a different host or environment-variable mapping under the same placeholder. • `sbx diagnose` now reports running CLI and shim processes, warns when global network policy is not initialized, and detects a ZFS setting that can make image builds unusually slow. • `sbx env` reports unknown keys and invalid values with their source file, line, column, and field. • `sbx mcp add` now completes OAuth discovery on networks that require an HTTP proxy without needing `--skip-ssrf-check`, and cloud commands, `sbx move`, the TUI, and cloud SSH now honor configured proxies, including system and PAC proxies. • Full templates now include a C/C++ toolchain for compiling native code inside the sandbox. • The Linux tarball installer now works for regular users on systems with AppArmor. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.48.0

Tue, 13 Oct 2026 12:29:44 GMT

v0.48.0 adds managed Codex/Claude Desktop SSH targets, v3 kit capabilities, and a unified `--format` output system with breaking CLI changes.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--format table`, `--format json`, `--format yaml`, and `--format github-issue` to `sbx diagnose` (replacing the old `--output` / `-o` flag) and `--format json`/`--format yaml` to `sbx prune --dry-run` for structured dry-run output; `--format json` and `--format yaml` are now mutually exclusive with `--json` and `-q`, and unsupported format values fail at flag-parse time instead of silently falling back to human-readable output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--detach` / `-d` to `sbx run` and `sbx env run` as the replacement for `--detached`, `--no-progress` to `sbx create` as the replacement for `--quiet` / `-q` (suppressing progress while still printing the creation summary), and `--env-name` to `sbx secret ls` and `sbx secret rm` as the replacement for `--env`. • Adds `sbx setup ssh --auto-create` on macOS and Windows to register Docker Sandbox connections in Codex and Claude Desktop, creating a dedicated sandbox on first use. • Adds `sbx mcp unload NAME --sandbox SANDBOX` to detach a loaded MCP server without restarting the sandbox's agent. • Adds `--ttl` and `--on-timeout restart` support to `sbx move --to cloud` and `sbx --cloud env create`, extending always-on timeout control beyond `sbx --cloud create`. • Adds `SBX_AGENT` environment variable inside sandbox containers, exposing the provisioned agent's name for kit hooks and scripts. • Adds `sbx kit add` support for kits with startup commands (running after the kit is added and on each subsequent sandbox start), V3 kit support for capability groups, `kit.env` references, bundled agent skills, and the `ssh-agent@1` and `git-identity@1` capabilities, and `sbx kit validate` rejection of kits whose credentials route the same host, identifying the conflicting services. • Sandbox-scoped custom secrets can now override global secrets that share the same environment variable name. • SSH-agent forwarding supports Windows OpenSSH and 1Password agents when `SSH_AUTH_SOCK` is not set. Breaking changes: • `--detached` on `sbx run` and `sbx env run` is rejected; replace with `--detach` or `-d`. • `--yes` / `-y` on `sbx logout` is rejected; replace with `--force` or `-f`. • `--auto-approve` / `-y` on `sbx env plan`, `sbx env create`, and `sbx env run` is rejected; replace with `--force` or `-f`. • `--quiet` / `-q` on `sbx create` is rejected; replace with `--no-progress`. • `-d` (short for description) on `sbx template save` is rejected; replace with `--description`. • `--output` / `-o` on `sbx diagnose` is rejected; replace with `--format table`, `--format json`, `--format yaml`, or `--format github-issue`. • `--env` on `sbx secret ls` and `sbx secret rm` is rejected; replace with `--env-name`. • `--quiet` / `-q` on `sbx policy log` is removed with no replacement. • `--format`, `--json`, and `-q` are mutually exclusive; even `--json --format json` is rejected. • Unsupported `--format` values now fail at flag-parse time instead of falling back to human-readable output. • `sbx ls --json` output changes: the top-level object `{"sandboxes": [...]}` is replaced by a bare array; update filters from `.sandboxes[].name` to `.[].name`. Fields are now `snake_case`, `created_at` and `last_used_at` use RFC 3339 timestamps, and rows include `detached`. • `sbx template ls --json` output changes: top-level `{"images": [...]}` is replaced by a bare array for local and cloud sandboxes. • `sbx mcp ls --json` locally: top-level `{"gateway": {...}, "servers": [...]}` is replaced by a bare server array; each row carries `gateway`. • `sbx policy log` output changes: local `allowed_hosts` / `blocked_hosts` and cloud camelCase fields are replaced by `{updated_at, allowed: [...], blocked: [...]}` with entries containing `sandbox_id`, `host`, `proxy_type`, `rule`, `reason`, `count`, `first_seen`, and `last_seen`. • `sbx --cloud policy ls` field names change from camelCase to `snake_case`. • `sbx ports` cloud rows rename `port` to `sandbox_port`; local rows use `host_ip`, `host_port`, `sandbox_port`, and `protocol`. • `sbx ports --publish` / `--unpublish` locally: structured formats now emit result rows with `action: published` or `action: unpublished`; warnings go to stderr. • Cloud `volume create`, `volume ls`, and `volume inspect` field names change from PascalCase (`ID`, `Name`, `CreatedAt`) to `snake_case` (`id`, `name`, `created_at`). `volume inspect` now defaults to a human-readable details view; use `--format json` for JSON. • `sbx rm`, `sbx stop`, `sbx template rm`, `sbx volume rm` structured output now returns an array of result objects with `action`, `resource`, `name`, and optional `id` and `error`; actions are lowercase strings. • Confirmation prompts require terminal input; piping an answer (e.g. `echo y | sbx secret set ...`) no longer confirms the operation — use `--force` / `-f` instead. • Declining a confirmation now returns a non-zero exit status consistently for removal, reset, and prune operations. • Read-only invocations and runs with `--force` no longer start an interactive sign-in flow; authentication must be completed before running automation. • Without a terminal, `sbx diagnose --upload` saves the diagnostic bundle but skips uploading and exits with status 0 — a zero exit no longer guarantees an upload occurred. • Without a terminal, `sbx create` and `sbx run` fail if the workspace directory does not exist (a `mkdir -p` hint is printed). • Ctrl-D at a selection or free-text prompt now cancels instead of accepting the default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.47.0

Mon, 05 Oct 2026 15:46:13 GMT

Docker Sandboxes v0.47.0 adds `sbx run --rm` auto-cleanup, long-running kit capability, and richer cloud TTL reporting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sbx run --rm` to automatically remove a local or cloud sandbox after its agent session ends (cannot be combined with `--detached`; cloud sandboxes interrupted by a dropped connection are kept and the CLI prints the removal command).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `com.docker.sandbox/long-running@1` kit capability declaration to keep local sandboxes running after all sessions disconnect (cloud sandboxes and `sbx kit add` cannot provide this capability: required entries are rejected, optional entries are skipped). • Adds `stopped` and `ttl_paused` fields to `sbx --cloud ttl` JSON output; stopped sandboxes are reported as stopped instead of expired, and the TTL restarts on resume. • `sbx settings set` now rejects invalid upstream proxy values before saving them. • Host-port collisions from `sbx ports --publish` now identify the occupied binding and offer a retry with an automatically allocated port. • MCP authorization requests `offline_access` when the server advertises it and authorization uses saved defaults or resource-required scopes, enabling servers to issue refresh tokens (run `sbx mcp auth` again to obtain a grant with a refresh token for existing credentials). • `sbx kit sign` and `sbx kit push --sign` now succeed on registries that refuse manifest deletion, including GitHub Container Registry and Docker Hub. • Kit pulls now enforce limits on registry-declared blob sizes, decompressed content, and archive entry counts. • Creating or moving a sandbox to the cloud now applies cloud policy and the kit's network rules without copying locally added network rules; moving a sandbox with local HTTP method or path restrictions warns that those restrictions will not apply in the cloud. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.46.0

Mon, 28 Sep 2026 17:17:11 GMT

Docker Sandboxes v0.46.0 adds restart-on-timeout for cloud sandboxes, kit-arg passthrough, and richer CLI diagnostics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--on-timeout restart` to `sbx --cloud create` so a sandbox that hits its time limit stops and immediately restarts instead of remaining stopped.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--kit-arg` and `--kit-args-file` flags to `sbx --cloud create` for passing values to kits supplied with `--kit`. • Adds `sbx diagnose --upload` returning a non-zero exit status on failed diagnostics uploads, enabling reliable script-level failure detection. • Adds `runtime_socket_limit_bytes` field to `sbx diagnose` output, reporting the socket-path length limit used by the container runtime. • `sbx env` reports unrecognized environment-file keys with the file, line, and column where they were declared, including across merged files. • Kits can now install files in the agent's skills directory when shared skills are read-only, without triggering a read-only filesystem error. • Kits added through the runtime API retain their network rules and applicable agent instructions when another kit addition recreates the sandbox container. • `sbx kit add` warns if it cannot save the updated sandbox record, explaining which kit settings could be lost and the conditions that would cause the loss. • Image paste in WSL2 falls back to the Windows clipboard when Linux clipboard tools return no image, requiring `clipboard.imagePaste` to be enabled. • Sandboxes created with the `balanced` network policy preset can now download Playwright browser binaries from `cdn.playwright.dev` over HTTPS. • Removing secrets in bulk now revokes credentials from running sandboxes, with failed revocations retryable even after stored secrets have been deleted. Breaking changes: • Secret commands configured with `sbx secret set --command`, `sbx secret set-custom --command`, or `secrets..command` in an environment file now execute from a fresh temporary directory on the host. Relative paths such as `./credential-helper` no longer resolve from the project directory or the directory where you ran `sbx`. Existing environments that declare secret commands will be prompted to approve a one-time plan change for the working directory on the next `sbx env run`. The execution change takes effect immediately after upgrading and restarting the daemon, even before that plan is approved. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.45.0

Mon, 21 Sep 2026 14:10:33 GMT

Docker Sandboxes v0.45.0 ships v3 OCI kits with workload/mixin composition, new model provider settings, and a raft of new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sbx run --model` support for any OpenAI- or Anthropic-compatible endpoint configured via the new `model.providers` setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sbx mcp add --disable-http2` to disable HTTP/2 for a remote MCP transport, working around servers whose HTTP/2 handling stalls long-lived streams. • Adds `--quiet` (`-q`) flag to MCP server, secret, skill, template, volume, and policy-profile list commands for name-only output. • Adds `--protocol` flag to local network allow rules so UDP can be selected explicitly alongside the default TCP coverage. • Adds `--created-via` filter to `sbx policy ls`, which also now shows how each rule was created. • Adds `--force` (and `--yes`/`-y` for `sbx kit builder history rm`) flags for non-interactive confirmation of destructive commands. • Adds `created_at`, CPU limits, and memory limits to `sbx ls --json` and `sbx inspect --json` output. • Adds `sbx kit validate` rejection of malformed API-key declarations, including invalid names, missing injection domains, invalid format placeholders, and Basic-auth usernames containing a colon, plus warnings for no-op or out-of-allowlist declarations. • Introduces v3 kits: OCI-based packages with separate workload and mixin roles that combine base environments, tools, configuration, credentials, network access, and agent instructions. • Introduces kit sets, letting authors combine a workload and mixins, pin component versions, and publish the result as a single OCI reference with its own capabilities, lifecycle hooks, instructions, and arguments. • V3 kits can scope network access by HTTP method and path, declare install-phase network access and credential use, and specify where an agent reads shared skills. • Multiple OAuth-backed agents can now be composed in the same sandbox with credentials scoped to the individual kits that request them. • Experimental outbound UDP now follows sandbox network policy. • Adding, updating, or removing global service secrets now updates existing local sandboxes without a restart. • OAuth refreshes are coordinated across sandboxes that share credentials, preventing simultaneous refreshes from forcing another sign-in. • Reverse-DNS lookups are now restricted to destination IPs already authorized by policy, closing a previous policy bypass. • DNS resolution is blocked when no network rule permits it. • `sbx policy allow network`, `sbx policy deny network`, `--allow-network`, and `--deny-network` now reject malformed patterns before saving them. • `sbx run opencode --model` now exposes the model's supported thinking levels as OpenCode variants, selectable with Ctrl+T. • The OpenCode kit now configures GitHub Copilot from the account's stored GitHub credential, enabling Copilot models without a separate device login. • macOS distributions now ship as a single signed `Sbx.app` bundle, with Homebrew and tarball PATH installs working via a symlink into the bundle. Breaking changes: • `sbx mcp catalog` has been removed; register a remote MCP server with `sbx mcp add` and then authorize it with `sbx mcp auth` instead. • `sbx secret rm` now returns an error on stderr when the requested secret does not exist (previously silent). • `sbx mcp rm` now returns an error when the requested MCP server is not registered (previously silent). • V3 workloads and mixins must be used together; they cannot be combined with v1 or v2 kits. • Commands that remove resources now prompt for confirmation and return a non-zero exit code when the prompt is declined; use `--force` or `--yes`/`-y` in non-interactive workflows. • `sbx exec -d` / `--detach` now fails immediately for unsupported detached execution instead of silently running in the foreground. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.45.0

Mon, 21 Sep 2026 14:10:33 GMT

Docker Sandboxes v0.45.0 ships v3 OCI kits with workload/mixin composition, new model provider settings, and a raft of new CLI flags.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sbx run --model` support for any OpenAI- or Anthropic-compatible endpoint configured via the new `model.providers` setting.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `sbx mcp add --disable-http2` to disable HTTP/2 for a remote MCP transport, working around servers whose HTTP/2 handling stalls long-lived streams. • Adds `--quiet` (`-q`) flag to MCP server, secret, skill, template, volume, and policy-profile list commands for name-only output. • Adds `--protocol` flag to local network allow rules so UDP can be selected explicitly alongside the default TCP coverage. • Adds `--created-via` filter to `sbx policy ls`, which also now shows how each rule was created. • Adds `--force` (and `--yes`/`-y` for `sbx kit builder history rm`) flags for non-interactive confirmation of destructive commands. • Adds `created_at`, CPU limits, and memory limits to `sbx ls --json` and `sbx inspect --json` output. • Adds `sbx kit validate` rejection of malformed API-key declarations, including invalid names, missing injection domains, invalid format placeholders, and Basic-auth usernames containing a colon, plus warnings for no-op or out-of-allowlist declarations. • Introduces v3 kits: OCI-based packages with separate workload and mixin roles that combine base environments, tools, configuration, credentials, network access, and agent instructions. • Introduces kit sets, letting authors combine a workload and mixins, pin component versions, and publish the result as a single OCI reference with its own capabilities, lifecycle hooks, instructions, and arguments. • V3 kits can scope network access by HTTP method and path, declare install-phase network access and credential use, and specify where an agent reads shared skills. • Multiple OAuth-backed agents can now be composed in the same sandbox with credentials scoped to the individual kits that request them. • Experimental outbound UDP now follows sandbox network policy. • Adding, updating, or removing global service secrets now updates existing local sandboxes without a restart. • OAuth refreshes are coordinated across sandboxes that share credentials, preventing simultaneous refreshes from forcing another sign-in. • Reverse-DNS lookups are now restricted to destination IPs already authorized by policy, closing a previous policy bypass. • DNS resolution is blocked when no network rule permits it. • `sbx policy allow network`, `sbx policy deny network`, `--allow-network`, and `--deny-network` now reject malformed patterns before saving them. • `sbx run opencode --model` now exposes the model's supported thinking levels as OpenCode variants, selectable with Ctrl+T. • The OpenCode kit now configures GitHub Copilot from the account's stored GitHub credential, enabling Copilot models without a separate device login. • macOS distributions now ship as a single signed `Sbx.app` bundle, with Homebrew and tarball PATH installs working via a symlink into the bundle. Breaking changes: • `sbx mcp catalog` has been removed; register a remote MCP server with `sbx mcp add` and then authorize it with `sbx mcp auth` instead. • `sbx secret rm` now returns an error on stderr when the requested secret does not exist (previously silent). • `sbx mcp rm` now returns an error when the requested MCP server is not registered (previously silent). • V3 workloads and mixins must be used together; they cannot be combined with v1 or v2 kits. • Commands that remove resources now prompt for confirmation and return a non-zero exit code when the prompt is declined; use `--force` or `--yes`/`-y` in non-interactive workflows. • `sbx exec -d` / `--detach` now fails immediately for unsupported detached execution instead of silently running in the foreground. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.43.0

Tue, 15 Sep 2026 13:00:22 GMT

Docker Sandboxes v0.43.0 adds tri-state skills sharing, overflow model routing, MCP custom headers, and richer sandbox lifecycle controls.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--skills=off|readonly|readwrite` flag to `sbx create`/`sbx run` for tri-state skills sharing (read-only by default); `--no-share-skills` still works as a deprecated alias for `--skills=off`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `skills.defaultMode` config key to set the desired default skills-sharing behaviour. • Adds `--overflow-provider`/`--overflow-model` flags to `sbx run --model` to pair a local model with a hosted fallback for oversized requests. • Adds `--header` flag to `sbx mcp add` to send custom request headers (with values substituted from the local secret vault) to remote MCP servers. • Environment files now support `${{ env.projectDir }}` and `${{ env.fileDir }}` variable references, and `~/.sbxenv.yaml` can mount each project's own directory via `workspace: ${{ env.projectDir }}`. • Every `sbx env` subcommand now accepts `--name` to override the sandbox name. • `sbx run --provider` now accepts hosted models.dev providers, served through llmman. • Adds `--skip-ssrf-check` flag to MCP authorization for private OAuth discovery. • Adds a last-used timestamp field to `sbx ls --json` output. • Adds Docker-style `until` filtering to `sbx prune`. • `sbx secret rm --sandbox` now immediately revokes the removed credential from the sandbox proxy. • `daemon inspect` and `inspect` now show mount information. • Clone-mode sandboxes now support shallow Git repositories. • Windows clients can now connect to `sandboxd` through filesystem `AF_UNIX` sockets. • The minimum sandbox memory has been decreased to 512 MiB (suitable for shell use cases). • Kits can now be installed through registry mirrors configured with an explicit port. • `sbx diagnose` now checks whether `mkfs.erofs` is usable and warns if its default block size exceeds the sandbox kernel's page size. • Plain `sbx version` invocations now return embedded version information without full CLI startup. Breaking changes: • `shareSkills` in `sbxenv.yaml` is replaced by `skills`; the new key accepts `off|readonly|readwrite` and the old key is no longer read. • MCP OAuth client secrets are renamed from `mcp:.client_secret` to `mcp::client_secret`; any secret stored under the old name must be re-set with `sbx secret set mcp::client_secret`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.42.0

Mon, 07 Sep 2026 08:15:49 GMT

Docker Sandboxes v0.42.0 adds cloud-hosted sandboxes via `sbx --cloud`, kit args, env-file args, and a new Devin agent. • Adds `sbx --cloud` to run AI agents on Docker-managed cloud infrastructure with commands such as `sbx --cloud run`, `sbx --cloud cp`, `sbx --cloud secret`, and `sbx --cloud policy` for file transfer, credentials, and outbound network policy. • Adds `sbx move` to copy a sandbox filesystem between local and cloud environments. • Adds `--json` output to read-only commands including `secret ls`, `version`, `mcp ls`, `skills ls`, `policy inspect`, and the `kit` verification commands. • Adds `sbx skills` to add, update, list, and remove sandbox skills directly from Git repositories. • Adds `sbx version --json` reporting of a `server.state` field with values `running` or `unavailable` so scripts can check backend reachability without parsing error text. • Adds `sbx mcp auth` scope control: requests only chosen scopes, accepts a new `--no-scope` flag to suppress server-required scopes, and reports granted/requested/supported scope sets in `sbx mcp auth status`. • Adds `--skip-auth` flag to `sbx mcp add` (the old `--skip_auth` still works) and allows `--url` on private, loopback, or cloud-metadata addresses with a warning instead of rejection. • Kits can now declare arguments in an `args:` block and receive values with `--kit-arg name=value` or `--kit-arg kit.name=value` to target a single kit; a `kits:` entry in `sbxenv.yaml` carries per-kit args under `kits[].args`. • Environment files can now declare their own arguments in an `args:` block, referenced as `${{ env.args.NAME }}` and supplied with `sbx env --env-arg`. • Adds `sbx run ` as the new positional form; the old `sbx run --kit ` is deprecated and `--kit` is now for mixins only. • Sandboxes can now be created without a workspace bind mount by omitting the path in `sbx create`. • Sets the default sandbox Docker volume to 10 GB (down from 50 GB) to reduce host disk usage; configurable via the `DOCKER_SANDBOXES_DOCKER_SIZE` environment variable. • Adds Devin as a built-in agent. • Adds a machine-wide Windows MSI installer (`DockerSandboxes.msi`) for administrator-managed installations. • `sbx env` now reads a non-hidden `sbxenv.yaml` in preference to `.sbxenv.yaml` when both are present, and merges `sbxenv.yaml` from the home directory as shared project defaults. • `sbx env` now shows a plan of everything an environment file changes on the host — `lifecycle:` commands, credentials, bindings, MCP servers, workspaces, kits, ports, and the sandbox itself — and prompts before applying; controlled by `env.rememberHostCommands`. • A registry mirror configured with `platform.images.registryMirror` is now also used by Docker running inside a sandbox when the value is a bare host with no path prefix. • Docker Sandboxes can now upload a diagnostics bundle automatically when the daemon hits an error, after opt-in. • A declined `@requireApproval` prompt on a local MCP server now generates its own audit record with policy attribution and a context digest. • Governance resolution issues are now shown in `sbx policy` output and the dashboard. • `sbx env create` now shares imported skills by default and accepts display, GPU, and USB options in `sbxenv.yaml`. • Clipboard commands inside local sandboxes can now copy text to the host clipboard. Breaking changes: • `sbx ports --publish` and kit-declared ports now default to `tcp4` instead of dual-stack `tcp`, so a published port no longer listens on `::1`; use `--publish 8080:3000/tcp` to restore dual-stack behaviour. • `${VAR}` interpolation in `.sbxenv.yaml` is no longer expanded; use the new `args:` block with `${{ env.args.NAME }}` syntax instead. • An environment file that declares no `workspace:` now creates a sandbox with no workspace bind mount; write `workspace: .` to mount the project directory as before. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.39.0

Wed, 19 Aug 2026 10:42:00 GMT

Docker Sandboxes v0.39.0 adds declarative `.sbxenv.yaml` environments, USB passthrough, bulk pruning, and kit signing via Sigstore. • Adds `sbx env run` to provision a complete, reproducible sandbox from a `.sbxenv.yaml` file (defining agent, workspace, kits, env vars, secrets, registry credentials, ports, and resource limits) and open an interactive session. • Adds `sbx env create`, `sbx env exec`, and `sbx env rm` to manage the full lifecycle of declarative sandbox environments. • Adds experimental `--usb` flag to `sbx create` (enabled via `DOCKER_SANDBOXES_FEATURE_SANDBOX_USB` environment variable) to re-attach specified USB devices inside a sandbox via usbfs; Linux x86_64/ARM64 only. • Adds `-e`/`--env` and `--env-file` flags to `sbx run` and `sbx create` for setting environment variables in a sandbox, following `docker run` precedence rules. • Adds `sbx prune` to bulk-clean stopped sandboxes, with filtering by how long each has been stopped; never removes a running sandbox. • Adds `--provider ollama` flag to `sbx run --model` to select the Ollama backend, replacing the former `ollama/` model-name prefix. • Adds `sbx kit sign` and `sbx kit verify` for signing and verifying kits with cosign-compatible Sigstore signatures, with optional policy enforcement at load time. • Adds `platform.images.registryMirror` setting to redirect Docker Hub-resolving sandbox template and kit images to an organization's registry mirror. • Exposes `SANDBOX_NAME` and `SANDBOX_ID` environment variables inside sandboxes, matching the values shown by `sbx ls --json`. • Enables Claude Code's `/remote-control` inside sandboxes via `sbx settings set claude.remoteControl true`. • Supports combining multiple `.sbxenv.yaml` environment files for shared configuration and local overrides, with host environment variable references for machine-specific paths and credentials. • Adds dynamic secret support to `sbx secret set` and `sbx secret set-custom`, with options to control refreshing, verification, and error output. • Extends `sbx diagnose` to report free disk space on the volume holding sandbox data and detect broken, shadowed, or stale SSH client configuration. • Allows OAuth kits to declare their credential file using the declarative `credentialFile.structure` form, rendered to well-formed JSON. Breaking changes: • `sbx run --model` no longer accepts the `ollama/` prefix to select the Ollama backend; use the new `--provider ollama` flag instead. • The `SANDBOX_VM_ID` environment variable inside sandboxes is deprecated in favor of `SANDBOX_NAME` and `SANDBOX_ID`. • Ubuntu 25.10 packages are no longer published (Ubuntu 25.10 is end-of-life). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.38.0

Thu, 06 Aug 2026 09:00:25 GMT

Docker Sandboxes v0.38.0 adds local model routing, first-class MCP management, enterprise proxy/NTLM/Kerberos support, and per-sandbox network deny rules. • Adds `sbx run --model claude` to serve a local GGUF model via llmman, or an already-running Ollama install using an `ollama/` prefix, routing Claude Code away from api.anthropic.com; enable with `sbx settings set platform.allowExperimentalFeatures true` and `sbx settings set feature.model true`. • Adds `sbx mcp` as a first-class, no-longer-hidden subcommand for MCP server management. • Adds `sbx mcp add` with `--dir` and OAuth override flags; registering a server immediately refreshes the `mcp-find`/`mcp-add` index in every running sandbox so new servers are discoverable without recreating sandboxes. • Adds `--deny-network HOST` flag to `sbx run` and `sbx create` for per-sandbox egress deny rules recorded at creation time. • Adds settings-driven upstream-proxy configuration via `proxy`, `proxy.sandbox`, `proxy.daemon`, and matching `no_proxy` keys, defaulting to the host OS system proxy and proxying daemon traffic (image pulls, telemetry) as well. • Adds `proxy.integratedAuth` setting to enable NTLM/Kerberos/Negotiate proxy authentication on Windows. • Adds `tls.allowNegativeSerial` setting for TLS-inspecting proxies that issue certificates with negative serial numbers. • Adds `sbx run --gpu` (experimental) for NVIDIA VFIO GPU passthrough on Linux; enable with `sbx settings set feature.sandbox-gpu true`. • Adds `sbx daemon restart` to stop and restart the sandboxd daemon in the background. • Adds `DOCKER_SANDBOXES_CLONED_WORKSPACE_SIZE` environment variable to configure the size of the cloned workspace volume. • Makes dynamic MCP tools `mcp-find`, `mcp-add`, and `mcp-config-set` available in local sandbox mode. • Extends `sbx mount ` so omitting a container target bind-mounts the host path at the same path inside the sandbox; `:ro` mounts are enforced read-only at the virtio-fs host edge. • `sbx inspect` now displays custom secrets configured for a sandbox. • Claude Vertex sandboxes now support `us` and `eu` multi-region endpoints. • Service and custom secrets are now global by default, with `--sandbox` for sandbox-scoped secrets. • Blocked HTTPS proxy connections now appear in `sbx policy log` even when the client aborts the TLS handshake. • Homebrew installs now use a stapled `.dmg` artifact instead of a `.tar.gz` archive, improving Gatekeeper compatibility on macOS. Breaking changes: • The `sbx mcp bundle` command has been removed; single-server management via `sbx mcp add`/`ls`/`rm` is the only supported flow. • Service and custom secrets default to global scope; legacy positional and `--global` forms are deprecated with warnings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.37.0

Fri, 24 Jul 2026 08:57:22 GMT

Docker Sandboxes v0.37.0 adds SSH access to sandboxes, shared agent skills, port publishing, and richer audit records. • Adds SSH access to sandboxes (experimental): run `sbx setup ssh` once to register a managed `*.sbx` SSH config entry, then connect to any sandbox with `ssh .sbx` from OpenSSH clients or remote-dev tools like VS Code and Cursor. • Adds `sbx skills import` to discover and import host agent skills into a persistent store shared across sandboxes, with `--dry-run` to preview and `--force` to overwrite existing skills. • New `--no-share-skills` flag on `sbx run` / `sbx create` lets individual sandboxes opt out of the shared skills store. • Adds `-p`/`--publish` flag to `sbx create` and `sbx run` for publishing sandbox ports at creation time. • New `DOCKER_SANDBOXES_PROXY=system` env var routes sandbox egress through the host OS proxy (macOS/Windows), including PAC auto-config URLs. • Audit now emits execution-outcome records for network egress (per allowed connection) and filesystem mounts (per allowed path), including success, latency, and error class. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.35.0

Fri, 10 Jul 2026 16:15:27 GMT

Docker Sandboxes v0.35.0 adds SOCKS5 proxy support, policy inspection/check commands, secret import, and a daemon management CLI. • Adds SOCKS5 upstream-proxy transport (`socks5://` / `socks5h://`) for sandbox egress via `DOCKER_SANDBOXES_PROXY`, `HTTP_PROXY`, or `HTTPS_PROXY`, with optional auth and `DOCKER_SANDBOXES_NO_PROXY` exclusions. • New `sbx policy inspect` command to examine policy details. • New `sbx policy check network` command to test whether the current policy would allow a network access request before executing. • Revamped `sbx policy ls` with `--wide`, `--source`, and `--decision` filters for concise policy listing. • New `sbx secret import` imports credential env vars into the keychain; `sbx secret ls` now flags env-only and OAuth-shadowed entries. Host env vars no longer auto-inject at runtime — migration required. • New `sbx daemon` command with `start`, `stop`, `status`, and `log-level` subcommands for daemon lifecycle management. • `sbx inspect` now surfaces the sandbox's kits, injected secrets, and sandbox information. • `sbx rm` now requires `--force` to delete an active session, preventing accidental teardown. • `sbx kit add` now recreates the sandbox container with the full kit set (preserving state) and applies the kit's network allow/deny rules and composed policy. • Kits can inject the user's Docker login token into requests to docker.com hosts via a credential with service `sbx-login`. • Re-attaching to a sandbox created with a custom `--kit` agent now works via `sbx run --name ` without re-passing `--kit`. • Enables virtiofs caching by default on all operating systems for faster filesystem performance (opt out with `DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=0`). • Balanced network preset now allows VS Code domains, Azure Blob Storage (`*.blob.core.windows.net`), and `dhi.io` over HTTP. • Droid OAuth credentials are now proxy-managed, keeping real tokens on the host and out of the sandbox. • Faster sandbox startup via optimized TLS-proxy CA installation (merging into trust bundle instead of running `update-ca-certificates`), saving several hundred milliseconds. Breaking changes: • Host env vars no longer auto-inject at runtime — use `sbx secret import` to migrate existing env-var-based secrets. • `sbx rm` now won't delete an active session unless `--force` is passed. • Installation is blocked on Windows versions older than Windows 11. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.35.0

Fri, 10 Jul 2026 16:15:27 GMT

Docker Sandboxes v0.35.0

Fri, 10 Jul 2026 16:15:27 GMT

Docker Sandboxes v0.34.0

Fri, 26 Jun 2026 14:19:38 GMT

Docker Sandboxes v0.34.0 adds a native SSH endpoint, `sbx setup` onboarding command, and OCI v2 kit streaming. • Adds experimental native SSH endpoint in sandboxd: connect with `ssh @127.0.0.1 -p 2222` (publickey auth, connect-to-create, interactive shell and exec), enabled via `sbx settings set feature.ssh true`. • Adds experimental `sbx setup` command that imports agent credentials from environment variables for smoother first-time onboarding. • Adds OCI v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory usage between reads. • Restricts kit installs to an allowlist of sources (defaulting to Docker Hub `docker.io/` only), configurable via `sbx settings set kit.allowedSources`. • Restores published sandbox ports on restart, with CLI/TUI able to recover explicit host-port conflicts by selecting a new host port. Breaking changes: • Installing a kit from a registry other than `docker.io/` or from a Git URL now fails until you add its prefix with `sbx settings set kit.allowedSources`. • `sbx policy set-default` is renamed to `sbx policy init`; the old name remains as a hidden, deprecated alias. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.34.0

Fri, 26 Jun 2026 14:19:38 GMT

Docker Sandboxes v0.34.0 adds a native SSH endpoint, kit source allowlisting, OCI v2 streaming, and a new onboarding command. • New experimental native SSH endpoint in sandboxd: connect with `ssh @127.0.0.1 -p 2222` (publickey auth, connect-to-create, interactive shell and exec). • New experimental `sbx setup` command imports agent credentials from environment variables for smoother first-time onboarding. • Adds OCI v2 kit artifact streaming that decompresses layers once to a cache directory and uses seek-based random access, reducing memory pressure during kit reads. • Restricts kit installs to an allowlist of sources (default: Docker Hub only); installing from other registries or Git URLs now fails unless explicitly permitted — **breaking change**. • Renames `sbx policy set-default` to `sbx policy init`; old name kept as a hidden deprecated alias. • Restores published sandbox ports on restart, with automatic recovery from host-port conflicts by selecting a new host port. Breaking changes: • Kit installs are restricted to an allowlist of sources defaulting to Docker Hub (`docker.io/`) only; installing a kit from another registry or a Git URL fails until you add its prefix with `sbx settings set kit.allowedSources`. • The `sbx policy set-default` command is renamed to `sbx policy init` (the old name still works as a hidden deprecated alias, but is deprecated). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.34.0

Fri, 26 Jun 2026 14:19:38 GMT

Docker Sandboxes v0.34.0

Fri, 26 Jun 2026 14:19:38 GMT

Docker Sandboxes v0.33.0

Wed, 17 Jun 2026 16:25:01 GMT

sbx v0.33.0 adds named sandbox identities, DNS-gated network policy, wildcard secrets, and virtiofs caching by default. • New `--name` flag for `sbx run` identifies a sandbox independent of working directory, enabling multiple named sandboxes per workspace and re-attachment from any directory. • `sbx ls --json` now reports a stable per-sandbox `id` field. • `sbx cp -L` now follows symlinks in the source path for sandbox-to-host copies. • Sandbox DNS lookups are now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039); loopback names remain exempt. • Outgoing ICMP from sandboxes is now blocked across daemon restarts (CVE-2026-12539). • MITM proxy now publishes a CRL and embeds a CRL distribution point in generated certificates, enabling revocation-strict clients (e.g. .NET) to work inside sandboxes. • `sbx secret set-custom --host` and `serviceDomains` in kits now accept wildcard host patterns (`*` for one label, `**` for any number) and are repeatable to cover multiple subdomains/domains. • Cursor OAuth is now supported as an agent. • virtiofs cache is now enabled by default on macOS and Linux for improved filesystem performance. • Build packages for `linux/arm64` are now produced. • Linux keychain backend now falls back to the encrypted on-disk store when `dbus-launch` is unavailable, supporting headless/server hosts. • Claude connectors (Slack, Gmail, Notion, Atlassian, etc.) now work inside sandboxed Claude Code without manual policy overrides. • Daemon inspect output is now included in the diagnostics bundle. Breaking changes: • The positional argument to `sbx run ` for re-attaching to an existing sandbox is deprecated and will be removed in a future release; use `sbx run --name ` instead (a deprecation warning is printed now). • `sbx run --name` no longer auto-creates numbered sibling sandboxes and errors when the requested agent doesn't match the named sandbox. • Sandbox DNS resolution is now blocked for domains denied by network policy, which may break sandboxed processes that previously resolved policy-denied domains. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.33.0

Wed, 17 Jun 2026 16:25:01 GMT

sbx v0.33.0 adds named sandbox identity, DNS-gated network policy, wildcard secrets, and Cursor OAuth support. • New `--name` flag for `sbx run` identifies a sandbox independently of the working directory, enabling multiple named sandboxes in the same workspace and re-attachment from any directory. • `sbx ls --json` now reports a stable per-sandbox `id` field for scripting and automation. • Sandbox DNS resolution is now gated on network policy, closing a DNS-based data-exfiltration channel (CVE-2026-12039); loopback names remain exempt. • Outgoing ICMP from sandboxes is now blocked persistently across daemon restarts (CVE-2026-12539). • `sbx secret set-custom --host` and `serviceDomains` in kits now accept wildcard host patterns (`*` for one label, `**` for any number) and are repeatable, allowing one secret to cover multiple subdomains. • Adds Cursor OAuth support as a recognized agent. • virtiofs cache is now enabled by default on macOS and Linux, improving filesystem performance. • Linux `arm64` build packages are now produced, extending platform support. • New keychain fallback to encrypted on-disk store on Linux when `dbus-launch` is unavailable, enabling headless/server deployments. • MITM proxy now publishes a CRL and embeds a CRL distribution point in generated certificates, supporting revocation-strict TLS clients (e.g., .NET). • Claude connectors (Slack, Gmail, Notion, Atlassian, etc.) now work inside sandboxed Claude Code without manual policy overrides. • `sbx cp -L` now follows symlinks in the source path for sandbox-to-host copies. • `sbx exec` now uses the same working directory as `sbx run`. Breaking changes: • The `sbx run ` positional argument form for re-attaching to an existing sandbox now prints a deprecation warning; the positional argument for `sbx run` is expected to be an agent (e.g. `claude`, `codex`), not a sandbox name, and the old positional-name form will be removed in a future release. • `sbx run --name` no longer auto-creates numbered sibling sandboxes when a same-named sandbox exists. • `sbx create` now errors when run without arguments instead of proceeding. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.33.0

Wed, 17 Jun 2026 16:25:01 GMT

Docker Sandboxes v0.33.0

Wed, 17 Jun 2026 16:25:01 GMT

Docker Sandboxes v0.32.0

Tue, 09 Jun 2026 09:11:48 GMT

Docker Sandboxes v0.32.0 adds audit logging, sign-in enforcement, OpenRouter secrets, OCI v2 kit support, and unhides custom secrets. • New audit logging emits structured JSONL records for every policy decision, written to a per-OS log directory and forwardable to any SIEM for enterprise compliance (requires Docker AI Governance subscription). • New sign-in enforcement lets admins require Docker organization membership verification, deployed via macOS configuration profiles, the Windows registry, or a JSON policy file on Linux. • Adds interactive 'Sign in with ChatGPT' OAuth flow on first `sbx create`/`sbx run codex` when no Codex credentials are configured. • Makes global the default scope for `policy network allow|deny` and `policy rm`; adds `--sandbox` flag to target a specific sandbox (drops the `-g/--global` flag). • Unhides `sbx secret set-custom` as an experimental command for setting custom secrets. • Adds OpenRouter as a built-in service provider so `sbx secret set openrouter` works without `set-custom`, with automatic `Authorization: Bearer ` injection. • Adds encrypted on-disk secrets store fallback on Linux/WSL hosts where no working keychain is available. • Supports custom-secret sentinel substitution inside HTTP Basic auth payloads. • Hides inactive governed policy rules by default in `sbx policy ls` and the TUI Network Rules view; adds `--include-inactive` flag (TUI `i` toggle) to reveal them. • Supports v2 OCI kit artifact format end-to-end, making kits standard OCI images inspectable by Hub, `oras`, `crane`, and `skopeo` without kit-specific knowledge. • Simplifies `sbx version` to a single line by default; gates detailed output behind `-D/--debug`. • Keeps virtiofs caching enabled for sandboxes using `--clone`, speeding up `git status`, `grep -r`, and tree walks by avoiding a FUSE round-trip on every stat(). Breaking changes: • The `-g/--global` flag is removed from `policy network allow|deny` and `policy rm`; global is now the default scope and `--sandbox` targets a specific sandbox instead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.31.0

Thu, 28 May 2026 16:11:08 GMT

Docker Sandboxes v0.31.0 adds clone-mode sandboxing, private registry secrets, and policy filters. • New `--clone` flag replaces `--branch`: sandboxes now run against an in-container read-only clone, keeping writes out of your host working tree and `.git/` • Host source repository is mounted read-only into the sandbox, with a shallow in-container clone; forge remotes (`origin`, `upstream`, etc.) are propagated so the agent can `git push` directly • Sandbox refs are mirrored to `refs/sandboxes//*` on the host and persist after the sandbox is removed, enabling branch recovery with `git branch` • Adds `sbx secret set --registry` to store container-registry pull credentials for pulling from private registries (GHCR, ACR, ECR, Quay, etc.) without `docker login` • Manage registry credentials with `sbx secret ls` and remove them with `sbx secret rm --registry ` • `sbx create` now auto-starts the daemon when it isn't running • Opt a sandbox into virtiofs caching at create time via `DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=1`; the setting is persisted in the spec across daemon restarts • Policy and rule names are now shown in CLI list output and TUI details • Adds filters to the policies listing • Verbose error reporting for kit apply failures • Allows public-CA CRL/OCSP/AIA endpoints in the balanced proxy preset Breaking changes: • The `--branch` flag has been removed; using `--branch` now fails with an error. Replace all uses of `--branch` with `--clone`. • The balanced proxy preset change (allowing public-CA CRL/OCSP/AIA endpoints) applies only to new installations or after running `sbx policy reset`, which removes any user-added rules. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.30.0

Tue, 19 May 2026 08:36:29 GMT

Docker Sandboxes v0.30.0 adds non-interactive Hub login, configurable auto-stop grace periods, and policy setup before login. • Adds non-interactive Docker Hub login to support scripted and CI/CD workflows. • Adds configurable grace period before a sandbox auto-stops when the last session exits. • Allows `sbx policy` setup to run before login, enabling pre-auth governance configuration. • Re-runs `commands.startup` on every container start, making init hooks idempotent across restarts. • Adds per-kit memory files for progressive disclosure of kit context to AI agents. • Enumerates installed kits in the AI memory file's Kits section. • Migrates `/reset` endpoint to `/daemon/reset` with state-dir wipe now handled daemon-side. • Binds both loopback stacks (IPv4 and IPv6) by default when publishing ports. • Allows raw TCP to `host.docker.internal` when localhost is permitted in policy. Breaking changes: • The `/reset` endpoint is replaced by `/daemon/reset`; any script or tooling calling `/reset` directly will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.29.0

Wed, 13 May 2026 14:11:36 GMT

Docker Sandboxes v0.29.0 adds per-sandbox network policies, daemon-assigned UUIDs, and a confirmation gate on `sbx rm`. • Supports per-sandbox scoped network policies for fine-grained egress control per sandbox instance. • Adds `deniedDomains` field to network kit policy to explicitly block specific domains. • Allows binary TCP protocols (e.g. SSH) through domain allow rules in network policy. • Adds daemon-assigned UUIDs to sandbox runtimes for reliable identification across restarts and telemetry. • Enables SSO browser relay for Gemini agent. • Auto-opens browser during OpenAI OAuth flow. • Exposes Claude guidance to Codex sandboxes. • Unhides `kit` command in help output, making it discoverable via `sbx --help`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.28.2

Wed, 29 Apr 2026 15:32:48 GMT

Docker Sandboxes v0.28.2 auto-opens the browser on login and adds SSH client tools to the main template. • Adds auto-open browser during the login flow, removing the need to manually copy-paste a URL. • Installs `ssh-add` and SSH client tools in the `main` template, enabling SSH agent and key operations out of the box. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.28.1

Tue, 28 Apr 2026 16:34:21 GMT

Docker Sandboxes v0.28.1 adds `--kit` for custom agent kits and in-process sandbox run/exec with launch/settings dialogs in the TUI. • Adds `--kit` flag to invoke custom agent kits from the CLI, now surfaced in `--help`. • Enables in-process sandbox run/exec with a launch mode dialog and settings dialog in the TUI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.27.0

Mon, 20 Apr 2026 18:25:53 GMT

Docker Sandboxes v0.27.0 adds Linux TUI support, governance visibility in `sbx policy ls`, and renames the Factory-ai agent to droid. • Supports Linux terminal spawning in the TUI across kitty, wezterm, alacritty, ghostty, gnome-terminal, konsole, xfce4-terminal, and xterm. • Surfaces active organization name and remote sync status in `sbx policy ls` output and the TUI governance tab. • Renames the Factory-ai agent to 'droid'. • Adds support for removing template images by image ID in addition to tags. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.24.2

Wed, 08 Apr 2026 17:55:23 GMT

Docker Sandboxes v0.24.2 adds a sandbox info dialog, improved TUI notifications, and better daemon error visibility. • Adds sandbox info dialog for viewing details of a running sandbox directly in the TUI. • Displays explanatory action messaging when creating a new sandbox. • Improves TUI notification system with updated styling and behavior. • Shows an error in the TUI when the daemon becomes unreachable. • Bypasses login check and network policy setup when running the 'reset' operation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes

Docker Sandboxes v0.21.0

Tue, 31 Mar 2026 15:09:08 GMT

Docker Sandboxes v0.21.0 adds network policy controls, `rm --all`, multi-worktree `--branch` flag, and standalone Linux binary. • New `policy reset` command restores default network policies for a sandbox. • Adds default network policy selection during sandbox creation. • Deduplicates network domain rules so one rule is created per domain. • New `rm --all` flag removes all sandboxes in a single command. • New `--branch` flag enables multiple worktrees inside one sandbox, using the branch name as the worktree path. • Adds `--preserve-credentials` / `--preserve-secrets` flag to `reset` for retaining secrets across resets. • Returns exit code 127 when a binary is missing in `sbx exec`, matching POSIX convention. • Handles Ctrl+Z to suspend the sbx process. • Supports configurable Docker volume size via environment variable for Docker-in-Docker (DinD). • Exposes internal error details in API error responses. • Supports dots in sandbox names by sanitizing Docker network names. • Adds Generic OAuth support for blueprint agents. • TUI gains reusable dialog open/close/resize animations and improved Warp terminal support. • Linux packaging now available as a standalone binary. • Points SSL_CERT_FILE, NODE_EXTRA_CA_CERTS, and REQUESTS_CA_BUNDLE at the full CA bundle. Breaking changes: • The `reset` flag `--preserve-credentials` is renamed to `--preserve-secrets`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/docker-sandboxes