docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-10-23 18:09:02 +03:00
Code Activity

sbx: vendor sbx v0.45.0 cli reference

Browse Source 
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
This commit is contained in:
David Karlsson
2026-09-22 15:27:05 +02:00
parent a6687a6260
commit 3bba652927
118 changed files with 1009 additions and 573 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
data/sbx_cli/sbx.yaml
View File

@@ -10,10 +10,6 @@ options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -23,7 +19,7 @@ options:
default_value: "false"
usage: help for sbx
see_also:
- sbx attach - Attach to a running cloud sandbox
- sbx attach - Attach to a cloud sandbox, starting it first if it is stopped
- sbx completion - Generate the autocompletion script for the specified shell
- sbx cp - Copy files or directories between a sandbox and the host
- sbx create - Create a sandbox for an agent
@@ -33,7 +29,7 @@ see_also:
- sbx exec - Execute a command inside a sandbox
- sbx kit - (Experimental) Manage kit artifacts
- sbx login - Sign in to Docker
- sbx logout - Stop all running sandboxes and sign out of Docker
- sbx logout - Stop running local sandboxes and sign out of Docker
- sbx ls - List sandboxes
- sbx mcp - Manage MCP servers
- sbx policy - Manage sandbox policies
@@ -43,6 +39,7 @@ see_also:
- sbx rm - Remove one or more sandboxes
- sbx run - Run an agent in a sandbox
- sbx secret - Manage stored secrets
- sbx settings - Manage Docker Sandboxes settings
- sbx setup - (Experimental) Detect host configuration and prepare Docker Sandboxes
- sbx skills - (Experimental) Manage skills available in sandboxes
- sbx stop - Stop one or more sandboxes without removing them

17
data/sbx_cli/sbx_attach.yaml
View File

@@ -1,20 +1,21 @@
name: sbx attach
synopsis: Attach to a running cloud sandbox
synopsis: |
Attach to a cloud sandbox, starting it first if it is stopped
description: |-
Attach an interactive terminal session to a running cloud sandbox.
Attach an interactive terminal session to a cloud sandbox.
SANDBOX is the cloud sandbox ID (sbx_*) or name from "sbx --cloud ls".
Opens a PTY-backed exec session against the sandbox's agent process. The
sandbox must already exist and be in a running state; use `sbx --cloud run`
to create a sandbox and attach in one step.
sandbox must already exist; a stopped one is started first. Use
`sbx --cloud run` to create a sandbox and attach in one step.
Only supported with --cloud. See https://docs.docker.com/ai/sandboxes/ for the cloud sandbox model.
usage: sbx attach SANDBOX [flags]
options:
- name: detach-keys
usage: |
Override the detach gesture that leaves the agent running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only).
Override the detach gesture that leaves the session running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only).
- name: help
shorthand: h
default_value: "false"
@@ -24,16 +25,12 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
example: |4-
# Attach to a running sandbox by ID or name
# Attach to a sandbox by ID or name
sbx --cloud attach sbx_abc123
sbx --cloud attach claude/my-sandbox
see_also:

4
data/sbx_cli/sbx_completion.yaml
View File

@@ -14,10 +14,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_completion_bash.yaml
View File

@@ -35,10 +35,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_completion_fish.yaml
View File

@@ -26,10 +26,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_completion_powershell.yaml
View File

@@ -23,10 +23,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_completion_zsh.yaml
View File

@@ -37,10 +37,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_cp.yaml
View File

@@ -24,10 +24,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

41
data/sbx_cli/sbx_create.yaml
View File

@@ -13,13 +13,24 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
Available agents: claude, codex, copilot, cursor, devin, docker-agent, droid, gemini, kiro, opencode, shell
With --cloud:
Create a cloud sandbox for an agent.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create [flags] AGENT|SANDBOX_KIT [PATH...]
options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -31,9 +42,8 @@ options:
usage: |
Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs)
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -71,7 +81,7 @@ options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -80,6 +90,9 @@ options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -92,9 +105,8 @@ options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -106,10 +118,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -135,6 +143,15 @@ example: |4-
# Run the agent on an in-container clone of the host repo, wired back via a git-daemon
sbx create --clone claude .
# Create a cloud sandbox for claude
sbx --cloud create claude
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project claude --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx - Manage AI coding agent sandboxes.
- sbx create claude - Create a sandbox for claude

39
data/sbx_cli/sbx_create_claude.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for claude.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create claude [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for claude
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create claude
# Create a cloud sandbox for claude
sbx --cloud create claude
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project claude --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

39
data/sbx_cli/sbx_create_codex.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for codex.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create codex [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for codex
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create codex
# Create a cloud sandbox for codex
sbx --cloud create codex
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project codex --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

39
data/sbx_cli/sbx_create_cursor.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for cursor.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create cursor [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for cursor
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create cursor
# Create a cloud sandbox for cursor
sbx --cloud create cursor
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project cursor --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

39
data/sbx_cli/sbx_create_devin.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for devin.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create devin [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for devin
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create devin
# Create a cloud sandbox for devin
sbx --cloud create devin
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project devin --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

39
data/sbx_cli/sbx_create_docker-agent.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for docker-agent.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create docker-agent [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for docker-agent
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create docker-agent
# Create a cloud sandbox for docker-agent
sbx --cloud create docker-agent
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project docker-agent --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

39
data/sbx_cli/sbx_create_gemini.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for gemini.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create gemini [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for gemini
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create gemini
# Create a cloud sandbox for gemini
sbx --cloud create gemini
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project gemini --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

39
data/sbx_cli/sbx_create_opencode.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for opencode.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create opencode [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for opencode
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create opencode
# Create a cloud sandbox for opencode
sbx --cloud create opencode
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project opencode --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

39
data/sbx_cli/sbx_create_shell.yaml
View File

@@ -13,7 +13,19 @@ description: |-
Use "sbx run --name SANDBOX" to attach to the agent after creation.
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
With --cloud:
Create a cloud sandbox for shell.
Cloud sandboxes have no host workspace, so no path follows the agent. Sizing
comes from --cpus and --memory and must land on a billable shape; without them
a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry.
Cloud sandboxes use cloud network policies. Host network and HTTP policies
do not apply. Set cloud account defaults with
"sbx --cloud policy init <allow-all|balanced|deny-all>".
Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation.
usage: sbx create shell [PATH...] [flags]
options:
- name: help
@@ -22,7 +34,6 @@ options:
usage: help for shell
inherited_options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -33,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: cpus
default_value: "0"
usage: |
@@ -46,9 +53,8 @@ inherited_options:
default_value: "false"
usage: Enable debug logging
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: env
shorthand: e
default_value: '[]'
@@ -82,7 +88,7 @@ inherited_options:
Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB)
- name: name
usage: |
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved)
Name for the sandbox (defaults to <agent>-<workdir>; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved)
- name: on-timeout
usage: |
What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it).
@@ -91,6 +97,9 @@ inherited_options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: quiet
shorthand: q
default_value: "false"
@@ -103,9 +112,8 @@ inherited_options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -124,5 +132,14 @@ example: |4-
# Create without a workspace bind mount
sbx create shell
# Create a cloud sandbox for shell
sbx --cloud create shell
# Create a named cloud sandbox with a mixin baked in
sbx --cloud create --name my-project shell --kit ./my-mixin/
# Create from a template that already exists in the cloud registry
sbx --cloud create -t TEMPLATE
see_also:
- sbx create - Create a sandbox for an agent

4
data/sbx_cli/sbx_daemon.yaml
View File

@@ -11,10 +11,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_daemon_log-level.yaml
View File

@@ -11,10 +11,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_daemon_log-level_set.yaml
View File

@@ -11,10 +11,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_daemon_restart.yaml
View File

@@ -11,10 +11,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_daemon_start.yaml
View File

@@ -18,10 +18,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_daemon_status.yaml
View File

@@ -14,10 +14,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_daemon_stop.yaml
View File

@@ -11,10 +11,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_diagnose.yaml
View File

@@ -20,10 +20,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

63
data/sbx_cli/sbx_env.yaml
View File

@@ -2,7 +2,7 @@ name: sbx env
synopsis: |
Manage sandboxes declaratively from an sbxenv.yaml file
experimental: true
description: |-
description: |
Manage a sandbox environment declared in an sbxenv.yaml file.
The file describes the agent, optional mixin kits, workspace mounts,
@@ -10,6 +10,16 @@ description: |-
bindings. Secrets are provisioned at the environment's sandbox scope so
`sbx env rm` can remove everything it created.
A secret with `command` or `ref` can set `snapshot: true` to resolve on
the host after approval and store the result as a literal. This works locally
and with --cloud. Snapshots do not refresh; recreate the environment to rotate
them. A snapshot cannot set refresh or noVerify.
secrets:
github:
command: gh auth token
snapshot: true
A file may declare its own inputs in an `args:` block, each with a default or
`required: true` and an optional description, enum, or pattern. Reference one
as `${{ env.args.NAME }}` anywhere a value appears and supply it with
@@ -150,6 +160,53 @@ description: |-
environment's commands are your own and run many times a day,
"sbx settings set env.rememberHostCommands true" asks about them only when
they change.
With --cloud, create, run, exec, rm and plan manage a cloud sandbox from the same
file. Supported declarations are agents and kits, sandbox environment variables,
CPU and memory sizing, literal or snapshot secrets and bindings for supported providers, and
host lifecycle commands. Kits can publish TCP ports through cloud endpoints.
Stored cloud secrets are inherited as with cloud create/run; sandbox-scoped secrets
override account defaults, and secrets declared in the file override both. The plan
shows inherited credentials. Removal deletes only secrets provisioned by this environment.
Bindings merge into the same global credentials.yaml as local environments and
are retained on removal unless --prune-bindings is passed. Cloud must advertise
kit credential support. Third-party kit domains must be approved by the binding;
creation refuses implicit provider-default routing for a bound secret. Bindings
and secrets are provisioned at creation; editing them requires recreating the sandbox.
Snapshot references use the host's supported CLI resolvers (such as op:// and AWS
Secrets Manager ARNs); the sdk backend is unsupported. An interrupted secret
upload reuses the saved value in the host credential store. If that value is
unavailable, resolution is not repeated: follow the recovery error before cleanup.
workspace, additionalWorkspaces and clone name host directories, which a cloud
sandbox cannot mount; remove them and clone the project inside the sandbox from a
kit instead. Host port bindings, registry credentials, MCP definitions, custom
credential providers, local sandbox options and dynamic secret sources are also
rejected before host commands or provisioning. Initialize commands may prepare
local kit sources; kit validation follows initialization and precedes cloud baking.
State belongs to this machine, the selected cloud endpoint, Docker identity and
ordered environment files. Use the same target and files for subsequent commands.
DOCKER_ACCESS_TOKEN uses a token-specific state scope: changing the token starts
with separate state. Use sbx login for state that survives token refresh.
If creation is interrupted, retry the same command and declaration within 23 hours.
Removal waits for unresolved writes to be recovered. Older unresolved attempts
retain their journal; the error names its path. Before deleting that journal,
confirm the original requests have finished and remove their sandbox and secrets
using ordinary cloud commands in the same account and endpoint. If the outcome
cannot be confirmed, retain the journal and contact support.
Lifecycle commands inherit the cloud endpoint and expose SBX_SANDBOX_ID after
creation. Sandbox env values apply to new sessions; rejoining a live agent keeps
that process's existing environment.
sbx --cloud env plan ./sbxenv.yaml
sbx --cloud env run --auto-approve --detached ./sbxenv.yaml
sbx --cloud env exec ./sbxenv.yaml -- git status
sbx --cloud env rm --force ./sbxenv.yaml
usage: sbx env COMMAND
options:
- name: help
@@ -161,10 +218,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_env_create.yaml
View File

@@ -75,10 +75,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

6
data/sbx_cli/sbx_env_exec.yaml
View File

@@ -37,7 +37,7 @@ options:
- name: detach
shorthand: d
default_value: "false"
usage: 'Detached mode: run command in the background'
usage: Detached mode (not supported)
- name: detach-keys
usage: Override the key sequence for detaching a container
- name: env
@@ -86,10 +86,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_env_plan.yaml
View File

@@ -76,10 +76,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_env_rm.yaml
View File

@@ -66,10 +66,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_env_run.yaml
View File

@@ -80,10 +80,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

12
data/sbx_cli/sbx_exec.yaml
View File

@@ -4,7 +4,8 @@ description: |-
Execute a command in a sandbox. If the sandbox is stopped, it is started first. Or — with --cloud — the cloud sandbox
ID (sbx_*) or name from "sbx --cloud ls".
Flags match the behavior of "docker exec". Some flags (-d, --user, --privileged)
Flags match the behavior of "docker exec", except detached exec (-d/--detach)
is not supported. Some flags (-d, --user, --privileged)
are not supported with --cloud and are rejected rather than silently ignored.
--detach-keys applies only to an interactive (-i/-t) cloud exec.
usage: sbx exec [flags] SANDBOX COMMAND [ARG...]
@@ -12,7 +13,7 @@ options:
- name: detach
shorthand: d
default_value: "false"
usage: 'Detached mode: run command in the background'
usage: Detached mode (not supported)
- name: detach-keys
usage: Override the key sequence for detaching a container
- name: env
@@ -48,10 +49,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -60,9 +57,6 @@ example: |4-
# Open a shell inside a sandbox
sbx exec -it my-sandbox bash
# Run a command in the background
sbx exec -d my-sandbox npm start
# Run as root
sbx exec -u root my-sandbox apt-get update

5
data/sbx_cli/sbx_kit.yaml
View File

@@ -18,10 +18,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -29,6 +25,7 @@ inherited_options:
see_also:
- sbx - Manage AI coding agent sandboxes.
- sbx kit add - Add a mixin to a sandbox
- sbx kit builder - Manage the kit builder sandbox
- sbx kit inspect - Display details about a kit artifact
- sbx kit pack - Package a directory as a kit artifact
- sbx kit provenance - Show the SLSA provenance attached to a kit

4
data/sbx_cli/sbx_kit_add.yaml
View File

@@ -37,10 +37,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

31
data/sbx_cli/sbx_kit_builder.yaml Normal file
View File

@@ -0,0 +1,31 @@
name: sbx kit builder
synopsis: Manage the kit builder sandbox
experimental: true
description: |-
Manage the kit builder sandbox.
Source-form kit builds (a local directory or git reference) run inside a
shared builder sandbox named sbx-kit-builder, created on first
use. Its Docker engine store doubles as the kit build cache, so removing
the builder is how the cache is reclaimed; the next source-form build
recreates it.
usage: sbx kit builder COMMAND
options:
- name: help
shorthand: h
default_value: "false"
usage: help for builder
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit - (Experimental) Manage kit artifacts
- sbx kit builder history - Inspect kit build history in the builder sandbox
- sbx kit builder rm - Remove the kit builder sandbox and its build cache
- sbx kit builder status - Show the kit builder sandbox and build-cache state

32
data/sbx_cli/sbx_kit_builder_history.yaml Normal file
View File

@@ -0,0 +1,32 @@
name: sbx kit builder history
synopsis: Inspect kit build history in the builder sandbox
experimental: true
description: |-
Inspect kit build history in the builder sandbox.
Each subcommand runs the matching docker buildx history command inside
the builder sandbox, against the buildx instance kit builds use. Flags
and arguments pass through verbatim.
usage: sbx kit builder history COMMAND
options:
- name: help
shorthand: h
default_value: "false"
usage: help for history
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder - Manage the kit builder sandbox
- sbx kit builder history export - Export a kit build record into a bundle
- sbx kit builder history inspect - Inspect a kit build record
- sbx kit builder history logs - Print a kit build's logs
- sbx kit builder history ls - List kit build records
- sbx kit builder history rm - Remove kit build records
- sbx kit builder history trace - Show the execution trace of a kit build

20
data/sbx_cli/sbx_kit_builder_history_export.yaml Normal file
View File

@@ -0,0 +1,20 @@
name: sbx kit builder history export
synopsis: Export a kit build record into a bundle
experimental: true
usage: sbx kit builder history export [ARGS...] [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for export
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder history - Inspect kit build history in the builder sandbox

20
data/sbx_cli/sbx_kit_builder_history_inspect.yaml Normal file
View File

@@ -0,0 +1,20 @@
name: sbx kit builder history inspect
synopsis: Inspect a kit build record
experimental: true
usage: sbx kit builder history inspect [ARGS...] [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for inspect
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder history - Inspect kit build history in the builder sandbox

20
data/sbx_cli/sbx_kit_builder_history_logs.yaml Normal file
View File

@@ -0,0 +1,20 @@
name: sbx kit builder history logs
synopsis: Print a kit build's logs
experimental: true
usage: sbx kit builder history logs [ARGS...] [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for logs
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder history - Inspect kit build history in the builder sandbox

20
data/sbx_cli/sbx_kit_builder_history_ls.yaml Normal file
View File

@@ -0,0 +1,20 @@
name: sbx kit builder history ls
synopsis: List kit build records
experimental: true
usage: sbx kit builder history ls [ARGS...] [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for ls
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder history - Inspect kit build history in the builder sandbox

25
data/sbx_cli/sbx_kit_builder_history_rm.yaml Normal file
View File

@@ -0,0 +1,25 @@
name: sbx kit builder history rm
synopsis: Remove kit build records
experimental: true
usage: sbx kit builder history rm [ARGS...] [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for rm
- name: "yes"
shorthand: "y"
default_value: "false"
usage: |
Skip confirmation prompt (buildx --force still controls running build records)
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder history - Inspect kit build history in the builder sandbox

20
data/sbx_cli/sbx_kit_builder_history_trace.yaml Normal file
View File

@@ -0,0 +1,20 @@
name: sbx kit builder history trace
synopsis: Show the execution trace of a kit build
experimental: true
usage: sbx kit builder history trace [ARGS...] [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for trace
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder history - Inspect kit build history in the builder sandbox

24
data/sbx_cli/sbx_kit_builder_rm.yaml Normal file
View File

@@ -0,0 +1,24 @@
name: sbx kit builder rm
synopsis: Remove the kit builder sandbox and its build cache
experimental: true
usage: sbx kit builder rm [flags]
options:
- name: force
shorthand: f
default_value: "false"
usage: Skip confirmation prompts and delete even if in use
- name: help
shorthand: h
default_value: "false"
usage: help for rm
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder - Manage the kit builder sandbox

20
data/sbx_cli/sbx_kit_builder_status.yaml Normal file
View File

@@ -0,0 +1,20 @@
name: sbx kit builder status
synopsis: Show the kit builder sandbox and build-cache state
experimental: true
usage: sbx kit builder status [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for status
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx kit builder - Manage the kit builder sandbox

4
data/sbx_cli/sbx_kit_inspect.yaml
View File

@@ -32,10 +32,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_kit_pack.yaml
View File

@@ -19,10 +19,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_kit_provenance.yaml
View File

@@ -43,10 +43,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_kit_pull.yaml
View File

@@ -28,10 +28,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_kit_push.yaml
View File

@@ -55,10 +55,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_kit_sign.yaml
View File

@@ -49,10 +49,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_kit_validate.yaml
View File

@@ -33,10 +33,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_kit_verify.yaml
View File

@@ -47,10 +47,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_login.yaml
View File

@@ -16,10 +16,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

6
data/sbx_cli/sbx_logout.yaml
View File

@@ -1,5 +1,5 @@
name: sbx logout
synopsis: Stop all running sandboxes and sign out of Docker
synopsis: Stop running local sandboxes and sign out of Docker
usage: sbx logout [flags]
options:
- name: help
@@ -15,10 +15,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_ls.yaml
View File

@@ -20,10 +20,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

6
data/sbx_cli/sbx_mcp.yaml
View File

@@ -13,10 +13,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -27,5 +23,5 @@ see_also:
- sbx mcp auth - Authorize MCP servers
- sbx mcp inspect - Show MCP server details
- sbx mcp load - Load an already-registered MCP server into a running sandbox
- sbx mcp ls - List MCP servers, grouped by the gateway that serves them
- sbx mcp ls - List MCP servers
- sbx mcp rm - Remove a registered MCP server

17
data/sbx_cli/sbx_mcp_add.yaml
View File

@@ -32,10 +32,11 @@ description: |-
legitimate servers live on private networks (split-horizon DNS, internal
load balancers, VPN-only endpoints, PrivateLink), so their public hostname
resolves to a private address and the warning is expected noise for them.
OAuth authorization-server metadata has a separate SSRF guard that blocks
disallowed addresses. Pass --skip-ssrf-check to disable both checks for this
add, including OAuth metadata redirects, when you trust the provider and
its discovery destinations; use it only for URLs you control.
OAuth authorization-server metadata has a separate SSRF guard with the same
warn-and-proceed posture: a disallowed address is logged, not blocked. Pass
--skip-ssrf-check to disable both checks for this add, including OAuth
metadata redirects (silencing the warning too), when you trust the provider
and its discovery destinations; use it only for URLs you control.
OAuth for remote endpoints (--oauth-authorization-server / --client-id):
Two related options configure OAuth for a remote --url server (both are
@@ -226,6 +227,10 @@ options:
usage: Executable to run for a local stdio server
- name: dir
usage: Working directory (cwd) for a --command host server
- name: disable-http2
default_value: "false"
usage: |
Do not negotiate HTTP/2 for this remote server, leaving HTTP/1.1. Applies to --url servers.
- name: header
default_value: '[]'
usage: |
@@ -267,10 +272,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

9
data/sbx_cli/sbx_mcp_auth.yaml
View File

@@ -9,10 +9,7 @@ description: |-
Running 'sbx mcp auth <server>' authorizes or reauthorizes one server. If the
stored credential is expired, sbx asks the control plane to refresh it first and
only falls back to interactive OAuth when refresh needs user consent. A name
with no local registration is resolved from the Docker MCP catalog and
authorized under its catalog name, so no 'sbx mcp add' is required for catalog
servers.
only falls back to interactive OAuth when refresh needs user consent.
Use 'sbx mcp auth status' to inspect hosted credential status without starting
OAuth, and 'sbx mcp auth rm' to remove hosted credentials without removing
@@ -78,10 +75,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

8
data/sbx_cli/sbx_mcp_auth_rm.yaml
View File

@@ -10,6 +10,10 @@ options:
- name: all
default_value: "false"
usage: Apply to all registered OAuth servers
- name: force
shorthand: f
default_value: "false"
usage: Skip confirmation prompts
- name: format
default_value: text
usage: 'Output format: "text" or "json"'
@@ -25,10 +29,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_mcp_auth_status.yaml
View File

@@ -24,10 +24,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_mcp_inspect.yaml
View File

@@ -14,10 +14,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

14
data/sbx_cli/sbx_mcp_load.yaml
View File

@@ -7,6 +7,13 @@ description: |-
The server must already exist in the local MCP store (register first with
'sbx mcp add'). Both remote/hosted and local-stdio servers are supported.
With --cloud:
Load an MCP server into a running cloud sandbox's gateway.
There is no local registration: the cloud gateway resolves the server name
itself, and the sandbox may be given by name or sbx_ ID. Connected agents see
the new server's tools immediately.
usage: sbx mcp load <name> --sandbox <sandbox> [flags]
options:
- name: help
@@ -20,10 +27,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -36,5 +39,8 @@ example: |4-
# Local stdio server.
sbx mcp add github --command npx --args @modelcontextprotocol/server-github
sbx mcp load github --sandbox my-sbx
# Cloud: load a gateway-known server into a cloud sandbox by name or ID
sbx --cloud mcp load notion --sandbox my-sbx
see_also:
- sbx mcp - Manage MCP servers

29
data/sbx_cli/sbx_mcp_ls.yaml
View File

@@ -1,10 +1,10 @@
name: sbx mcp ls
synopsis: List MCP servers, grouped by the gateway that serves them
synopsis: List MCP servers
description: |-
List registered MCP servers under the gateway that serves them.
The gateway header reports where it runs, who controls it, and whether you are
signed in; each server row reports its transport and whether it is usable now.
The GATEWAY column reports where each server runs, who controls it, and the
signed-in identity; each row also reports its transport and whether it is usable now.
Servers needing authorization carry the 'sbx mcp auth' next step.
A server registered with custom headers is marked as such; one whose header
@@ -15,6 +15,15 @@ description: |-
Auth status is read without starting an OAuth flow — from the local token store
in local data-plane mode, otherwise from the hosted control plane.
With --cloud:
List MCP servers reported by existing cloud sandbox gateways, with the
sandboxes that reference each server. Servers skipped by a gateway are excluded.
This is not a complete inventory of configured servers: unused configurations
and gateways that do not report server names are absent, including with --quiet.
Specify a sandbox to show its gateway state and host, requested servers, and
skipped servers.
usage: sbx mcp ls [flags]
options:
- name: help
@@ -24,15 +33,15 @@ options:
- name: json
default_value: "false"
usage: Output in JSON format
- name: quiet
shorthand: q
default_value: "false"
usage: Only display MCP server names
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -42,5 +51,11 @@ example: |4-
# Machine-readable output for scripting
sbx mcp ls --json
# Cloud: list servers reported across existing sandboxes
sbx --cloud mcp ls
# Cloud: show a cloud sandbox's gateway by name or sbx_ ID
sbx --cloud mcp ls my-sbx
see_also:
- sbx mcp - Manage MCP servers

8
data/sbx_cli/sbx_mcp_rm.yaml
View File

@@ -2,6 +2,10 @@ name: sbx mcp rm
synopsis: Remove a registered MCP server
usage: sbx mcp rm <name> [flags]
options:
- name: force
shorthand: f
default_value: "false"
usage: Skip confirmation prompts
- name: help
shorthand: h
default_value: "false"
@@ -11,10 +15,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_policy.yaml
View File

@@ -17,10 +17,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_policy_allow.yaml
View File

@@ -17,10 +17,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

24
data/sbx_cli/sbx_policy_allow_network.yaml
View File

@@ -3,9 +3,16 @@ synopsis: Allow network access to specified hosts
description: |-
Allow sandbox network access to the specified hosts.
RESOURCES is a comma-separated list of hostnames, domains, or IP addresses.
Supports exact domains (example.com), wildcard subdomains (*.example.com),
and optional port suffixes (example.com:443). Use "**" to allow all hosts.
RESOURCES is a comma-separated list of hostnames, domains, IP addresses, or
CIDR prefixes. Rules apply to TCP by default; use --protocol to select UDP or
both transports. Supports exact domains (example.com), wildcard subdomains
(*.example.com), multi-label wildcards (**.example.com), single-character
globs (api?.example.com), character classes (api[12].example.com,
api[!1].example.com), and optional port suffixes (example.com:443). An IPv6
address takes a port in brackets ([2001:db8::1]:443) or a CIDR prefix
(2001:db8::1/128); a bare one is refused. Use "**" to allow all hosts. A bare
"*", an escaped glob character such as "\*", and any other pattern outside
these forms are rejected rather than stored as a rule that matches nothing.
The rule applies globally to all sandboxes by default. Use --sandbox to add
the rule to policy "local" scoped to a single sandbox instead.
@@ -15,6 +22,9 @@ options:
shorthand: h
default_value: "false"
usage: help for network
- name: protocol
usage: |
Network protocol: tcp or udp; repeat or comma-separate for both
- name: sandbox
usage: |
Scope the rule to a specific sandbox (default: all sandboxes)
@@ -23,10 +33,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -44,7 +50,7 @@ example: |4-
# Allow all subdomains of a host
sbx policy allow network "*.npmjs.org"
# Allow all outbound traffic
sbx policy allow network "**"
# Allow all outbound traffic on both transports
sbx policy allow network --protocol tcp,udp "**"
see_also:
- sbx policy allow - Add an allow rule for sandboxes

4
data/sbx_cli/sbx_policy_check.yaml
View File

@@ -16,10 +16,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

9
data/sbx_cli/sbx_policy_check_network.yaml
View File

@@ -5,7 +5,8 @@ description: |-
TARGET may be a hostname, host:port, IP literal, or URL. Bare hosts and IP
literals are evaluated with port 443. HTTP(S) URLs use their default ports;
other URL schemes must include an explicit port.
other URL schemes must include an explicit port. URLs supply only their host
and port: this command evaluates network authorization, not HTTP method or path.
usage: sbx policy check network [--sandbox SANDBOX] TARGET [flags]
options:
- name: help
@@ -15,6 +16,8 @@ options:
- name: json
default_value: "false"
usage: Output in JSON format
- name: protocol
usage: 'Network protocol to evaluate: tcp or udp'
- name: sandbox
usage: Evaluate in a specific sandbox policy context
- name: verbose
@@ -25,10 +28,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_policy_deny.yaml
View File

@@ -16,10 +16,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

21
data/sbx_cli/sbx_policy_deny_network.yaml
View File

@@ -3,9 +3,12 @@ synopsis: Deny network access to specified hosts
description: |-
Block sandbox network access to the specified hosts.
RESOURCES is a comma-separated list of hostnames, domains, or IP addresses.
Deny rules take precedence over allow rules for the same hostname or CIDR. An
allowed hostname isn't checked against CIDR rules for its resolved IP address.
RESOURCES takes the same forms as "sbx policy allow network": exact domains,
wildcard subdomains, IP addresses, and CIDR prefixes, with optional port
suffixes. Rules apply to TCP and UDP by default; use --protocol to restrict a
rule to one transport. Deny rules take precedence over allow rules for the
same hostname or CIDR. An allowed hostname isn't checked against CIDR rules
for its resolved IP address.
The rule applies globally to all sandboxes by default. Use --sandbox to add
the rule to policy "local" scoped to a single sandbox instead.
@@ -15,6 +18,9 @@ options:
shorthand: h
default_value: "false"
usage: help for network
- name: protocol
usage: |
Restrict the rule to one protocol: tcp or udp (default tcp,udp)
- name: sandbox
usage: |
Scope the rule to a specific sandbox (default: all sandboxes)
@@ -23,10 +29,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -38,7 +40,10 @@ example: |4-
# Block a host only for a specific sandbox
sbx policy deny network --sandbox my-sandbox ads.example.com
# Block all outbound traffic
# Block all outbound traffic, TCP and UDP
sbx policy deny network "**"
# Block only UDP to a host
sbx policy deny network --protocol udp media.example.com
see_also:
- sbx policy deny - Add a deny rule for sandboxes

18
data/sbx_cli/sbx_policy_init.yaml
View File

@@ -18,6 +18,14 @@ description: |-
After initializing, use "sbx policy allow/deny/rm" to change the global policy.
Use "sbx policy reset" to clear all policies and start over.
With --cloud:
Set the default network mode of the cloud policy.
There is no one-time setup: init sets the default mode for the account, or for
one sandbox with --sandbox, keeps the existing allow and deny rules, and can be
run again. balanced is deny-all plus the balanced allow list added to the scope.
Use "sbx --cloud policy reset" to clear the rules first.
usage: sbx policy init <allow-all|balanced|deny-all> [flags]
options:
- name: help
@@ -31,10 +39,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -49,5 +53,11 @@ example: |4-
# Block everything, then allow specific sites
sbx policy init deny-all
sbx policy allow network api.example.com:443
# Set the account default to balanced
sbx --cloud policy init balanced
# Block everything for one sandbox, keeping its allow rules
sbx --cloud policy init deny-all --sandbox my-sandbox
see_also:
- sbx policy - Manage sandbox policies

4
data/sbx_cli/sbx_policy_inspect.yaml
View File

@@ -25,10 +25,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_policy_log.yaml
View File

@@ -31,10 +31,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

14
data/sbx_cli/sbx_policy_ls.yaml
View File

@@ -18,6 +18,9 @@ description: |-
rule.
usage: sbx policy ls [SANDBOX] [flags]
options:
- name: created-via
usage: |
Filter policies by how they were created: "default", "added", "provisioned", or "approval"
- name: decision
usage: 'Filter policies by decision: "allow" or "deny"'
- name: help
@@ -30,12 +33,14 @@ options:
- name: json
default_value: "false"
usage: Output filtered policy rules as JSON
- name: protocol
usage: 'Filter network rules by protocol: tcp or udp'
- name: source
usage: 'Filter policies by source: "local", "org", or "kit"'
- name: type
default_value: all
usage: |
Filter policies by type: "all", "network", or "filesystem" (default "all")
Filter policies by type: "all", "network", "filesystem" (default "all")
- name: wide
default_value: "false"
usage: Show detailed rule-level output with rule IDs and resources
@@ -44,10 +49,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -71,6 +72,9 @@ example: |4-
# List organization policies that deny access
sbx policy ls --source org --decision deny
# List persistent rules created from approval prompts
sbx policy ls --wide --created-via approval
# Include inactive rules hidden by remote governance
sbx policy ls --include-inactive
see_also:

8
data/sbx_cli/sbx_policy_reset.yaml
View File

@@ -9,6 +9,10 @@ description: |-
If sandboxes are currently running, they will be stopped when the daemon
shuts down. You will be prompted for confirmation unless --force is used.
With --cloud, deletes the custom cloud network policy for your account and
leaves the local daemon alone. You will be prompted for confirmation unless
--force is used. Afterwards the default the server now stores is printed.
usage: sbx policy reset [flags]
options:
- name: force
@@ -24,10 +28,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_policy_rm.yaml
View File

@@ -12,10 +12,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

25
data/sbx_cli/sbx_policy_rm_network.yaml
View File

@@ -12,9 +12,22 @@ description: |-
remove from policy "local" scoped to a single sandbox instead.
Use "sbx policy ls --wide" to see active rule IDs and resources, or
"sbx policy ls --json" for the raw filtered daemon response.
"sbx policy ls --json" for the filtered rules; network values are printed in
the form the CLI accepts back.
With --cloud:
Remove a cloud network rule by pattern.
Cloud rules have no IDs: --resource removes the pattern from both the allow
and deny lists, and the output names each list it was removed from. The rule
leaves the account policy by default; use --sandbox to scope the removal to one
sandbox. Use "sbx --cloud policy ls" to see the current rules.
usage: sbx policy rm network [--sandbox SANDBOX] [flags]
options:
- name: force
shorthand: f
default_value: "false"
usage: Skip confirmation prompts
- name: help
shorthand: h
default_value: "false"
@@ -31,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -51,5 +60,11 @@ example: |4-
# Remove a sandbox-scoped rule by resource
sbx policy rm network --sandbox my-sandbox --resource api.example.com
# Remove a cloud rule by pattern, from the allow or deny list it is in
sbx --cloud policy rm network --resource api.example.com
# Remove a pattern from one cloud sandbox's rules
sbx --cloud policy rm network --sandbox my-sandbox --resource api.example.com
see_also:
- sbx policy rm - Remove a policy rule

24
data/sbx_cli/sbx_ports.yaml
View File

@@ -24,9 +24,15 @@ description: |-
published with that same default or as dual-stack tcp. Name the protocol to
remove a tcp6 or udp mapping; anything left behind is reported.
In cloud mode (--cloud), the sandbox may be given by ID (sbx_*) or name, and
only the sandbox port number is accepted. The cloud control plane assigns a
publicly reachable URL for each exposed port.
With --cloud:
Manage the exposed ports of a cloud sandbox.
List, publish, or unpublish ports on a cloud sandbox given by ID (sbx_*) or
name. Without --publish or --unpublish flags, lists the exposed ports.
A port is the sandbox port number alone or with a /tcp suffix; UDP and host
bindings are refused. The cloud control plane assigns a publicly reachable URL
for each exposed port.
usage: sbx ports SANDBOX [flags]
options:
- name: help
@@ -39,20 +45,16 @@ options:
- name: publish
default_value: '[]'
usage: |
Publish a port (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT (cloud)
Publish a port (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT[/tcp] (cloud)
- name: unpublish
default_value: '[]'
usage: |
Unpublish a port (can be repeated): [HOST_IP:]HOST_PORT:SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT (cloud)
Unpublish a port (can be repeated): [HOST_IP:]HOST_PORT:SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT[/tcp] (cloud)
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -71,9 +73,9 @@ example: |4-
sbx ports my-sandbox --unpublish 3000:8080
# Expose port 8080 on a cloud sandbox
sbx ports sbx_abc123 --cloud --publish 8080
sbx --cloud ports sbx_abc123 --publish 8080
# Remove an exposed port from a cloud sandbox
sbx ports sbx_abc123 --cloud --unpublish 8080
sbx --cloud ports sbx_abc123 --unpublish 8080
see_also:
- sbx - Manage AI coding agent sandboxes.

4
data/sbx_cli/sbx_prune.yaml
View File

@@ -51,10 +51,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_reset.yaml
View File

@@ -42,10 +42,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

9
data/sbx_cli/sbx_rm.yaml
View File

@@ -7,7 +7,10 @@ description: |-
For local sandboxes, stops them, removes their containers, cleans up any Git
worktrees, deletes sandbox state, and deletes secrets scoped to each removed
sandbox. This action cannot be undone. With --cloud, deletes
the sandbox in Docker Sandboxes Cloud. This action cannot be undone.
the sandbox in Docker Sandboxes Cloud. This action cannot be undone. Once the
server accepts the request, rm waits up to 60 seconds per sandbox for the
deletion. A removal still completing after that exits 0. Verify it later with
"sbx --cloud ls".
Removal requires confirmation; use --force to skip confirmation prompts
(for non-interactive scripts) and to delete a sandbox that is in use
@@ -34,10 +37,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

65
data/sbx_cli/sbx_run.yaml
View File

@@ -23,22 +23,34 @@ description: |-
pass --detached (-d) to print the sandbox ID and exit without opening an
interactive session.
With --cloud: the agent runs in the cloud sandbox image (started server-side).
Running an agent that has existing sandboxes (running or stopped) prompts you
to pick one to reuse or to create a new one. Pass --new to skip the prompt and
always create a fresh sandbox. --detached also skips the prompt and always
creates a new sandbox; a non-interactive run without --detached is refused.
Use --detached for non-interactive scripting (e.g.
sbx --cloud run -d claude && sbx --cloud exec ...).
Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB.
Templates referenced via -t / --template must already exist in the cloud registry;
the CLI does not upload them automatically. See https://docs.docker.com/ai/sandboxes/ for the cloud sandbox model.
Available agents: claude, codex, copilot, cursor, devin, docker-agent, droid, gemini, kiro, opencode, shell
With --cloud:
Run an agent in a cloud sandbox, creating the sandbox if it does not already exist.
The first positional argument identifies the agent to run: a built-in agent
name or a sandbox kit reference (a local directory, ZIP file, git repository,
or OCI reference). Relative local references must be explicit paths such as
./my-kit or ../my-kit.zip. Cloud sandboxes have no host workspace, so no path
follows the agent. Pass agent arguments after the "--" separator.
Running an agent that has existing sandboxes, running or stopped, prompts you
to pick one to reuse or to create a new one. Pass --new to skip the prompt and
always create a fresh sandbox. --name NAME reuses and restarts the sandbox of
that name when it exists and creates it otherwise. A launch that bakes a kit
template (a sandbox kit or a mixin with build content) always creates fresh.
--detached skips the prompt: with --name it restarts that sandbox when it
exists, otherwise it creates a new one. A non-interactive run without
--detached is refused, so scripts pass --detached (e.g.
sbx --cloud run -d claude && sbx --cloud exec ...).
Sizing comes from --cpus and --memory and must land on a billable shape; without
them a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template
must already exist in the cloud registry; the CLI does not upload it. See
https://docs.docker.com/ai/sandboxes/ for the cloud sandbox model.
usage: sbx run [flags] [AGENT|SANDBOX_KIT] [PATH...] [-- AGENT_ARGS...]
options:
- name: allow-network
default_value: '[]'
usage: |
Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times)
- name: clone
@@ -50,12 +62,16 @@ options:
usage: |
Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs)
- name: deny-network
default_value: '[]'
usage: |
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls <NAME>` / `sbx policy rm network --sandbox <NAME> --resource <HOST>`. Safe under centralized governance because a local deny can only narrow, never widen, egress.
Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls <NAME>' or 'sbx policy rm network --sandbox <NAME> --resource <HOST>'. Safe under centralized governance because a local deny can only narrow, never widen, egress.
- name: detach-keys
usage: |
Override the detach gesture that leaves the agent running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only).
Override the detach gesture that leaves the session running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only).
- name: detached
shorthand: d
default_value: "false"
usage: |
Start the sandbox and print its ID without opening an agent session
- name: env
shorthand: e
default_value: '[]'
@@ -105,6 +121,9 @@ options:
default_value: '[]'
usage: |
Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]. Applied when the sandbox is created; ignored when re-attaching (use "sbx ports")
- name: pull
default_value: always
usage: Image pull policy (always|missing|never)
- name: skills
usage: |
Shared skills store mode: off, readonly, or readwrite (mounted at the agent's skills directory, e.g. ~/.claude/skills). Default: readonly, or the configured skills.defaultMode setting. Can only be used when creating a new sandbox.
@@ -113,9 +132,8 @@ options:
usage: |
Container image to use for the sandbox (default: agent-specific image)
- name: ttl
default_value: 0s
usage: |
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side)
Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side)
- name: volume
shorthand: v
default_value: '[]'
@@ -127,10 +145,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
@@ -160,7 +174,16 @@ example: |4-
# Run a sandbox with agent arguments
sbx run claude -- --continue
# Run claude in a new cloud sandbox
sbx --cloud run claude
# Create a cloud sandbox non-interactively and print its ID
sbx --cloud run --detached claude
# Reuse the cloud sandbox of that name, creating it when it does not exist
sbx --cloud run --name my-project claude
# Run with agent arguments
sbx --cloud run claude -- --continue
see_also:
- sbx - Manage AI coding agent sandboxes.

4
data/sbx_cli/sbx_secret.yaml
View File

@@ -25,10 +25,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_secret_import.yaml
View File

@@ -43,10 +43,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

8
data/sbx_cli/sbx_secret_ls.yaml
View File

@@ -18,6 +18,10 @@ options:
- name: json
default_value: "false"
usage: Output in JSON format
- name: quiet
shorthand: q
default_value: "false"
usage: Only display secret names
- name: sandbox
usage: Only list secrets for one sandbox
- name: service
@@ -27,10 +31,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

14
data/sbx_cli/sbx_secret_rm.yaml
View File

@@ -20,21 +20,21 @@ options:
- name: registry
usage: Registry hostname to remove pull credentials for
- name: sandbox
usage: 'Scope the removal to one sandbox (default: global)'
usage: |
Scope the removal to one sandbox (default: all scopes when choosing interactively, global with SERVICE)
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
example: |4-
# Choose an existing secret to remove with the arrow keys
sbx secret rm
# Remove a global secret
sbx secret rm github
@@ -60,5 +60,9 @@ example: |4-
# Remove every stored secret across every scope (service secrets, custom
# secrets, OAuth tokens, and registry credentials)
sbx secret rm --all
# Remove a cloud custom secret by its name, or by a host it routes
sbx --cloud secret rm api-example-com
sbx --cloud secret rm --host api.example.com
see_also:
- sbx secret - Manage stored secrets

19
data/sbx_cli/sbx_secret_set-custom.yaml
View File

@@ -16,12 +16,22 @@ description: |-
Custom secrets apply globally by default. Use --sandbox to scope one to a
specific sandbox.
With --cloud, --host takes exact DNS names only (no IP addresses or wildcards)
and the proxy sets --header on requests to those hosts instead of substituting
the placeholder.
usage: sbx secret set-custom [flags]
options:
- name: command
usage: Use a command's standard output as the secret value
- name: env
usage: Set this env var in the sandbox to the placeholder value
- name: format
usage: |
How the value fills the header, with one %s; default "Bearer %s" when --header is omitted (with --cloud)
- name: header
usage: |
HTTP header the proxy sets to the secret on requests to --host; default Authorization (with --cloud)
- name: help
shorthand: h
default_value: "false"
@@ -29,7 +39,10 @@ options:
- name: host
default_value: '[]'
usage: |
Host, IP, or wildcard pattern (e.g. *.example.com); repeatable
Host, IP, or wildcard pattern (e.g. *.example.com); repeatable; with --cloud, exact DNS names only
- name: name
usage: |
Secret name; default derived from the first --host (with --cloud)
- name: no-verify
default_value: "false"
usage: Skip checking the --ref or --command source when storing it
@@ -58,10 +71,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_secret_set.yaml
View File

@@ -88,10 +88,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

32
data/sbx_cli/sbx_settings.yaml Normal file
View File

@@ -0,0 +1,32 @@
name: sbx settings
synopsis: Manage Docker Sandboxes settings
description: |-
View and manage settings for Docker Sandboxes.
Settings can come from defaults, environment variables, or user overrides.
These commands use the local daemon to read evaluated values and manage
overrides, starting it if necessary.
Most changes take effect within about five seconds. Some require a daemon
restart.
usage: sbx settings COMMAND
options:
- name: help
shorthand: h
default_value: "false"
usage: help for settings
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
see_also:
- sbx - Manage AI coding agent sandboxes.
- sbx settings get - Get the value of a setting
- sbx settings list - List settings
- sbx settings set - Set a setting override
- sbx settings unset - Remove a setting override

33
data/sbx_cli/sbx_settings_get.yaml Normal file
View File

@@ -0,0 +1,33 @@
name: sbx settings get
synopsis: Get the value of a setting
description: |-
Print the evaluated value of a setting.
Use --json to print the complete setting record, including its source, type,
default, and description.
usage: sbx settings get <key> [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for get
- name: json
default_value: "false"
usage: Print the complete setting record as JSON
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
example: |4-
# Get a setting value
sbx settings get proxy.daemon
# Get in JSON format with source info
sbx settings get --json proxy.daemon
see_also:
- sbx settings - Manage Docker Sandboxes settings

39
data/sbx_cli/sbx_settings_list.yaml Normal file
View File

@@ -0,0 +1,39 @@
name: sbx settings list
synopsis: List settings
description: |-
List known settings with their evaluated value, type, source, and description.
The SOURCE column shows where the value came from (default, envvar, or
override). RESTART identifies settings that require 'sbx daemon restart' for
existing daemon-side consumers. Long values and descriptions are truncated to
keep the table readable; use --no-trunc or --json for complete output. Use
'sbx settings get <key>' to print one value in full.
usage: sbx settings list [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for list
- name: json
default_value: "false"
usage: Print complete setting records as JSON
- name: no-trunc
default_value: "false"
usage: Show full values and descriptions, one setting per block
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
example: |4-
# List settings as a table
sbx settings list
# List settings as JSON
sbx settings list --json
see_also:
- sbx settings - Manage Docker Sandboxes settings

39
data/sbx_cli/sbx_settings_set.yaml Normal file
View File

@@ -0,0 +1,39 @@
name: sbx settings set
synopsis: Set a setting override
description: |-
Set a user override for a setting.
The value is parsed according to the setting's type:
bool "true" or "false"
int integer value
float floating-point value
string plain text
json raw JSON
Environment variables take precedence over user overrides.
Most changes take effect within about five seconds. If a daemon restart is
required, this command tells you to run 'sbx daemon restart'.
usage: sbx settings set <key> <value> [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for set
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
example: |4-
# Route sandbox, daemon, and CLI egress through an upstream proxy
sbx settings set proxy http://proxy.example.com:3128
# Pull template and kit images through a registry mirror
sbx settings set platform.images.registryMirror artifactory.corp/docker-remote
see_also:
- sbx settings - Manage Docker Sandboxes settings

26
data/sbx_cli/sbx_settings_unset.yaml Normal file
View File

@@ -0,0 +1,26 @@
name: sbx settings unset
synopsis: Remove a setting override
description: |-
Remove the user override for a setting.
The setting then evaluates from its environment variable or default value.
usage: sbx settings unset <key> [flags]
options:
- name: help
shorthand: h
default_value: "false"
usage: help for unset
inherited_options:
- name: cloud
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: debug
shorthand: D
default_value: "false"
usage: Enable debug logging
example: |4-
# Remove the override for a setting
sbx settings unset proxy.daemon
see_also:
- sbx settings - Manage Docker Sandboxes settings

4
data/sbx_cli/sbx_setup.yaml
View File

@@ -21,10 +21,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_setup_ssh.yaml
View File

@@ -23,10 +23,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_setup_ssh_remove.yaml
View File

@@ -12,10 +12,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_skills.yaml
View File

@@ -18,10 +18,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_skills_add.yaml
View File

@@ -32,10 +32,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

4
data/sbx_cli/sbx_skills_import.yaml
View File

@@ -44,10 +44,6 @@ inherited_options:
default_value: "false"
usage: |
Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list)
- name: cloud-api-url
default_value: https://api.sandboxes-cloud.docker.com
usage: |
Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted.
- name: debug
shorthand: D
default_value: "false"

Some files were not shown because too many files have changed in this diff Show More