From 3bba652927bfadefe694448ea609e013bc06e1d5 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Tue, 22 Sep 2026 15:27:05 +0200 Subject: [PATCH] sbx: vendor sbx v0.45.0 cli reference Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- data/sbx_cli/sbx.yaml | 9 +-- data/sbx_cli/sbx_attach.yaml | 17 ++--- data/sbx_cli/sbx_completion.yaml | 4 -- data/sbx_cli/sbx_completion_bash.yaml | 4 -- data/sbx_cli/sbx_completion_fish.yaml | 4 -- data/sbx_cli/sbx_completion_powershell.yaml | 4 -- data/sbx_cli/sbx_completion_zsh.yaml | 4 -- data/sbx_cli/sbx_cp.yaml | 4 -- data/sbx_cli/sbx_create.yaml | 41 ++++++++---- data/sbx_cli/sbx_create_claude.yaml | 39 +++++++---- data/sbx_cli/sbx_create_codex.yaml | 39 +++++++---- data/sbx_cli/sbx_create_cursor.yaml | 39 +++++++---- data/sbx_cli/sbx_create_devin.yaml | 39 +++++++---- data/sbx_cli/sbx_create_docker-agent.yaml | 39 +++++++---- data/sbx_cli/sbx_create_gemini.yaml | 39 +++++++---- data/sbx_cli/sbx_create_opencode.yaml | 39 +++++++---- data/sbx_cli/sbx_create_shell.yaml | 39 +++++++---- data/sbx_cli/sbx_daemon.yaml | 4 -- data/sbx_cli/sbx_daemon_log-level.yaml | 4 -- data/sbx_cli/sbx_daemon_log-level_set.yaml | 4 -- data/sbx_cli/sbx_daemon_restart.yaml | 4 -- data/sbx_cli/sbx_daemon_start.yaml | 4 -- data/sbx_cli/sbx_daemon_status.yaml | 4 -- data/sbx_cli/sbx_daemon_stop.yaml | 4 -- data/sbx_cli/sbx_diagnose.yaml | 4 -- data/sbx_cli/sbx_env.yaml | 63 ++++++++++++++++-- data/sbx_cli/sbx_env_create.yaml | 4 -- data/sbx_cli/sbx_env_exec.yaml | 6 +- data/sbx_cli/sbx_env_plan.yaml | 4 -- data/sbx_cli/sbx_env_rm.yaml | 4 -- data/sbx_cli/sbx_env_run.yaml | 4 -- data/sbx_cli/sbx_exec.yaml | 12 +--- data/sbx_cli/sbx_kit.yaml | 5 +- data/sbx_cli/sbx_kit_add.yaml | 4 -- data/sbx_cli/sbx_kit_builder.yaml | 31 +++++++++ data/sbx_cli/sbx_kit_builder_history.yaml | 32 +++++++++ .../sbx_kit_builder_history_export.yaml | 20 ++++++ .../sbx_kit_builder_history_inspect.yaml | 20 ++++++ .../sbx_cli/sbx_kit_builder_history_logs.yaml | 20 ++++++ data/sbx_cli/sbx_kit_builder_history_ls.yaml | 20 ++++++ data/sbx_cli/sbx_kit_builder_history_rm.yaml | 25 +++++++ .../sbx_kit_builder_history_trace.yaml | 20 ++++++ data/sbx_cli/sbx_kit_builder_rm.yaml | 24 +++++++ data/sbx_cli/sbx_kit_builder_status.yaml | 20 ++++++ data/sbx_cli/sbx_kit_inspect.yaml | 4 -- data/sbx_cli/sbx_kit_pack.yaml | 4 -- data/sbx_cli/sbx_kit_provenance.yaml | 4 -- data/sbx_cli/sbx_kit_pull.yaml | 4 -- data/sbx_cli/sbx_kit_push.yaml | 4 -- data/sbx_cli/sbx_kit_sign.yaml | 4 -- data/sbx_cli/sbx_kit_validate.yaml | 4 -- data/sbx_cli/sbx_kit_verify.yaml | 4 -- data/sbx_cli/sbx_login.yaml | 4 -- data/sbx_cli/sbx_logout.yaml | 6 +- data/sbx_cli/sbx_ls.yaml | 4 -- data/sbx_cli/sbx_mcp.yaml | 6 +- data/sbx_cli/sbx_mcp_add.yaml | 17 ++--- data/sbx_cli/sbx_mcp_auth.yaml | 9 +-- data/sbx_cli/sbx_mcp_auth_rm.yaml | 8 +-- data/sbx_cli/sbx_mcp_auth_status.yaml | 4 -- data/sbx_cli/sbx_mcp_inspect.yaml | 4 -- data/sbx_cli/sbx_mcp_load.yaml | 14 ++-- data/sbx_cli/sbx_mcp_ls.yaml | 29 +++++++-- data/sbx_cli/sbx_mcp_rm.yaml | 8 +-- data/sbx_cli/sbx_policy.yaml | 4 -- data/sbx_cli/sbx_policy_allow.yaml | 4 -- data/sbx_cli/sbx_policy_allow_network.yaml | 24 ++++--- data/sbx_cli/sbx_policy_check.yaml | 4 -- data/sbx_cli/sbx_policy_check_network.yaml | 9 ++- data/sbx_cli/sbx_policy_deny.yaml | 4 -- data/sbx_cli/sbx_policy_deny_network.yaml | 21 +++--- data/sbx_cli/sbx_policy_init.yaml | 18 +++-- data/sbx_cli/sbx_policy_inspect.yaml | 4 -- data/sbx_cli/sbx_policy_log.yaml | 4 -- data/sbx_cli/sbx_policy_ls.yaml | 14 ++-- data/sbx_cli/sbx_policy_reset.yaml | 8 +-- data/sbx_cli/sbx_policy_rm.yaml | 4 -- data/sbx_cli/sbx_policy_rm_network.yaml | 25 +++++-- data/sbx_cli/sbx_ports.yaml | 24 +++---- data/sbx_cli/sbx_prune.yaml | 4 -- data/sbx_cli/sbx_reset.yaml | 4 -- data/sbx_cli/sbx_rm.yaml | 9 ++- data/sbx_cli/sbx_run.yaml | 65 +++++++++++++------ data/sbx_cli/sbx_secret.yaml | 4 -- data/sbx_cli/sbx_secret_import.yaml | 4 -- data/sbx_cli/sbx_secret_ls.yaml | 8 +-- data/sbx_cli/sbx_secret_rm.yaml | 14 ++-- data/sbx_cli/sbx_secret_set-custom.yaml | 19 ++++-- data/sbx_cli/sbx_secret_set.yaml | 4 -- data/sbx_cli/sbx_settings.yaml | 32 +++++++++ data/sbx_cli/sbx_settings_get.yaml | 33 ++++++++++ data/sbx_cli/sbx_settings_list.yaml | 39 +++++++++++ data/sbx_cli/sbx_settings_set.yaml | 39 +++++++++++ data/sbx_cli/sbx_settings_unset.yaml | 26 ++++++++ data/sbx_cli/sbx_setup.yaml | 4 -- data/sbx_cli/sbx_setup_ssh.yaml | 4 -- data/sbx_cli/sbx_setup_ssh_remove.yaml | 4 -- data/sbx_cli/sbx_skills.yaml | 4 -- data/sbx_cli/sbx_skills_add.yaml | 4 -- data/sbx_cli/sbx_skills_import.yaml | 4 -- data/sbx_cli/sbx_skills_ls.yaml | 8 +-- data/sbx_cli/sbx_skills_rm.yaml | 4 -- data/sbx_cli/sbx_skills_update.yaml | 4 -- data/sbx_cli/sbx_stop.yaml | 14 ++-- data/sbx_cli/sbx_template.yaml | 15 +++-- data/sbx_cli/sbx_template_inspect.yaml | 10 +-- data/sbx_cli/sbx_template_load.yaml | 34 +++++----- data/sbx_cli/sbx_template_ls.yaml | 8 +-- data/sbx_cli/sbx_template_rm.yaml | 14 ++-- data/sbx_cli/sbx_template_save.yaml | 15 ++--- data/sbx_cli/sbx_ttl.yaml | 7 +- data/sbx_cli/sbx_tui.yaml | 4 -- data/sbx_cli/sbx_version.yaml | 4 -- data/sbx_cli/sbx_volume.yaml | 4 -- data/sbx_cli/sbx_volume_create.yaml | 4 -- data/sbx_cli/sbx_volume_inspect.yaml | 4 -- data/sbx_cli/sbx_volume_ls.yaml | 8 +-- data/sbx_cli/sbx_volume_rm.yaml | 4 -- 118 files changed, 1009 insertions(+), 573 deletions(-) create mode 100644 data/sbx_cli/sbx_kit_builder.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_history.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_history_export.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_history_inspect.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_history_logs.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_history_ls.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_history_rm.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_history_trace.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_rm.yaml create mode 100644 data/sbx_cli/sbx_kit_builder_status.yaml create mode 100644 data/sbx_cli/sbx_settings.yaml create mode 100644 data/sbx_cli/sbx_settings_get.yaml create mode 100644 data/sbx_cli/sbx_settings_list.yaml create mode 100644 data/sbx_cli/sbx_settings_set.yaml create mode 100644 data/sbx_cli/sbx_settings_unset.yaml diff --git a/data/sbx_cli/sbx.yaml b/data/sbx_cli/sbx.yaml index 5959592db2..91d457adc0 100644 --- a/data/sbx_cli/sbx.yaml +++ b/data/sbx_cli/sbx.yaml @@ -10,10 +10,6 @@ options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -23,7 +19,7 @@ options: default_value: "false" usage: help for sbx see_also: - - sbx attach - Attach to a running cloud sandbox + - sbx attach - Attach to a cloud sandbox, starting it first if it is stopped - sbx completion - Generate the autocompletion script for the specified shell - sbx cp - Copy files or directories between a sandbox and the host - sbx create - Create a sandbox for an agent @@ -33,7 +29,7 @@ see_also: - sbx exec - Execute a command inside a sandbox - sbx kit - (Experimental) Manage kit artifacts - sbx login - Sign in to Docker - - sbx logout - Stop all running sandboxes and sign out of Docker + - sbx logout - Stop running local sandboxes and sign out of Docker - sbx ls - List sandboxes - sbx mcp - Manage MCP servers - sbx policy - Manage sandbox policies @@ -43,6 +39,7 @@ see_also: - sbx rm - Remove one or more sandboxes - sbx run - Run an agent in a sandbox - sbx secret - Manage stored secrets + - sbx settings - Manage Docker Sandboxes settings - sbx setup - (Experimental) Detect host configuration and prepare Docker Sandboxes - sbx skills - (Experimental) Manage skills available in sandboxes - sbx stop - Stop one or more sandboxes without removing them diff --git a/data/sbx_cli/sbx_attach.yaml b/data/sbx_cli/sbx_attach.yaml index 3e8a9ff3bf..40cd65f848 100644 --- a/data/sbx_cli/sbx_attach.yaml +++ b/data/sbx_cli/sbx_attach.yaml @@ -1,20 +1,21 @@ name: sbx attach -synopsis: Attach to a running cloud sandbox +synopsis: | + Attach to a cloud sandbox, starting it first if it is stopped description: |- - Attach an interactive terminal session to a running cloud sandbox. + Attach an interactive terminal session to a cloud sandbox. SANDBOX is the cloud sandbox ID (sbx_*) or name from "sbx --cloud ls". Opens a PTY-backed exec session against the sandbox's agent process. The - sandbox must already exist and be in a running state; use `sbx --cloud run` - to create a sandbox and attach in one step. + sandbox must already exist; a stopped one is started first. Use + `sbx --cloud run` to create a sandbox and attach in one step. Only supported with --cloud. See https://docs.docker.com/ai/sandboxes/ for the cloud sandbox model. usage: sbx attach SANDBOX [flags] options: - name: detach-keys usage: | - Override the detach gesture that leaves the agent running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only). + Override the detach gesture that leaves the session running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only). - name: help shorthand: h default_value: "false" @@ -24,16 +25,12 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" usage: Enable debug logging example: |4- - # Attach to a running sandbox by ID or name + # Attach to a sandbox by ID or name sbx --cloud attach sbx_abc123 sbx --cloud attach claude/my-sandbox see_also: diff --git a/data/sbx_cli/sbx_completion.yaml b/data/sbx_cli/sbx_completion.yaml index 60427acc07..dfcfa4ef55 100644 --- a/data/sbx_cli/sbx_completion.yaml +++ b/data/sbx_cli/sbx_completion.yaml @@ -14,10 +14,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_completion_bash.yaml b/data/sbx_cli/sbx_completion_bash.yaml index 7e7b9964e0..6b96a7864a 100644 --- a/data/sbx_cli/sbx_completion_bash.yaml +++ b/data/sbx_cli/sbx_completion_bash.yaml @@ -35,10 +35,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_completion_fish.yaml b/data/sbx_cli/sbx_completion_fish.yaml index f1bbc5e0b5..9f8449fcd0 100644 --- a/data/sbx_cli/sbx_completion_fish.yaml +++ b/data/sbx_cli/sbx_completion_fish.yaml @@ -26,10 +26,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_completion_powershell.yaml b/data/sbx_cli/sbx_completion_powershell.yaml index b9dd7d456a..dab9c1aba4 100644 --- a/data/sbx_cli/sbx_completion_powershell.yaml +++ b/data/sbx_cli/sbx_completion_powershell.yaml @@ -23,10 +23,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_completion_zsh.yaml b/data/sbx_cli/sbx_completion_zsh.yaml index 854d70a50e..f1c646bf3c 100644 --- a/data/sbx_cli/sbx_completion_zsh.yaml +++ b/data/sbx_cli/sbx_completion_zsh.yaml @@ -37,10 +37,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_cp.yaml b/data/sbx_cli/sbx_cp.yaml index 15e1f231e6..d0673f4d91 100644 --- a/data/sbx_cli/sbx_cp.yaml +++ b/data/sbx_cli/sbx_cp.yaml @@ -24,10 +24,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_create.yaml b/data/sbx_cli/sbx_create.yaml index 2000a25a60..e37d57d0e2 100644 --- a/data/sbx_cli/sbx_create.yaml +++ b/data/sbx_cli/sbx_create.yaml @@ -13,13 +13,24 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. - Available agents: claude, codex, copilot, cursor, devin, docker-agent, droid, gemini, kiro, opencode, shell + + With --cloud: + Create a cloud sandbox for an agent. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create [flags] AGENT|SANDBOX_KIT [PATH...] options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -31,9 +42,8 @@ options: usage: | Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs) - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -71,7 +81,7 @@ options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -80,6 +90,9 @@ options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -92,9 +105,8 @@ options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -106,10 +118,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -135,6 +143,15 @@ example: |4- # Run the agent on an in-container clone of the host repo, wired back via a git-daemon sbx create --clone claude . + + # Create a cloud sandbox for claude + sbx --cloud create claude + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project claude --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx - Manage AI coding agent sandboxes. - sbx create claude - Create a sandbox for claude diff --git a/data/sbx_cli/sbx_create_claude.yaml b/data/sbx_cli/sbx_create_claude.yaml index c1ca939417..ea9723021c 100644 --- a/data/sbx_cli/sbx_create_claude.yaml +++ b/data/sbx_cli/sbx_create_claude.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for claude. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create claude [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for claude inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create claude + + # Create a cloud sandbox for claude + sbx --cloud create claude + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project claude --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_codex.yaml b/data/sbx_cli/sbx_create_codex.yaml index 4f917a8a7a..974963dbb8 100644 --- a/data/sbx_cli/sbx_create_codex.yaml +++ b/data/sbx_cli/sbx_create_codex.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for codex. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create codex [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for codex inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create codex + + # Create a cloud sandbox for codex + sbx --cloud create codex + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project codex --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_cursor.yaml b/data/sbx_cli/sbx_create_cursor.yaml index 51e2be84dc..453fb2bb68 100644 --- a/data/sbx_cli/sbx_create_cursor.yaml +++ b/data/sbx_cli/sbx_create_cursor.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for cursor. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create cursor [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for cursor inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create cursor + + # Create a cloud sandbox for cursor + sbx --cloud create cursor + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project cursor --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_devin.yaml b/data/sbx_cli/sbx_create_devin.yaml index 46a8b8c3b3..ac5fb0c0a2 100644 --- a/data/sbx_cli/sbx_create_devin.yaml +++ b/data/sbx_cli/sbx_create_devin.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for devin. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create devin [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for devin inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create devin + + # Create a cloud sandbox for devin + sbx --cloud create devin + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project devin --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_docker-agent.yaml b/data/sbx_cli/sbx_create_docker-agent.yaml index b4ded68295..879dec2cef 100644 --- a/data/sbx_cli/sbx_create_docker-agent.yaml +++ b/data/sbx_cli/sbx_create_docker-agent.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for docker-agent. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create docker-agent [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for docker-agent inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create docker-agent + + # Create a cloud sandbox for docker-agent + sbx --cloud create docker-agent + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project docker-agent --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_gemini.yaml b/data/sbx_cli/sbx_create_gemini.yaml index 683e3cbe32..27d1e92813 100644 --- a/data/sbx_cli/sbx_create_gemini.yaml +++ b/data/sbx_cli/sbx_create_gemini.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for gemini. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create gemini [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for gemini inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create gemini + + # Create a cloud sandbox for gemini + sbx --cloud create gemini + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project gemini --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_opencode.yaml b/data/sbx_cli/sbx_create_opencode.yaml index 27e7153c57..e1d0412e29 100644 --- a/data/sbx_cli/sbx_create_opencode.yaml +++ b/data/sbx_cli/sbx_create_opencode.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for opencode. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create opencode [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for opencode inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create opencode + + # Create a cloud sandbox for opencode + sbx --cloud create opencode + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project opencode --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_create_shell.yaml b/data/sbx_cli/sbx_create_shell.yaml index 23ebb87a3b..07bfc04bcf 100644 --- a/data/sbx_cli/sbx_create_shell.yaml +++ b/data/sbx_cli/sbx_create_shell.yaml @@ -13,7 +13,19 @@ description: |- Use "sbx run --name SANDBOX" to attach to the agent after creation. - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. + With --cloud: + Create a cloud sandbox for shell. + + Cloud sandboxes have no host workspace, so no path follows the agent. Sizing + comes from --cpus and --memory and must land on a billable shape; without them + a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry. + + Cloud sandboxes use cloud network policies. Host network and HTTP policies + do not apply. Set cloud account defaults with + "sbx --cloud policy init ". + + Use "sbx --cloud run --name SANDBOX" to attach to the agent after creation. usage: sbx create shell [PATH...] [flags] options: - name: help @@ -22,7 +34,6 @@ options: usage: help for shell inherited_options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -33,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: cpus default_value: "0" usage: | @@ -46,9 +53,8 @@ inherited_options: default_value: "false" usage: Enable debug logging - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: env shorthand: e default_value: '[]' @@ -82,7 +88,7 @@ inherited_options: Memory limit in binary units (e.g., 512m, 8g). Minimum: 512 MiB. Default: 50% of host memory, clamped to 512 MiB–32 GiB. Maximum: max(75% of host memory, 512 MiB) - name: name usage: | - Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods; 'default' is reserved) + Name for the sandbox (defaults to -; at least two characters, starting with a letter or number, containing only letters, numbers, hyphens and periods (periods are rejected with --cloud); 'default' is reserved) - name: on-timeout usage: | What happens when --ttl lapses: 'delete' (default) tombstones the sandbox, or 'stop' stops it in place so it can be started again later (cloud only; 'stop' requires your account to be entitled to it). @@ -91,6 +97,9 @@ inherited_options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: quiet shorthand: q default_value: "false" @@ -103,9 +112,8 @@ inherited_options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -124,5 +132,14 @@ example: |4- # Create without a workspace bind mount sbx create shell + + # Create a cloud sandbox for shell + sbx --cloud create shell + + # Create a named cloud sandbox with a mixin baked in + sbx --cloud create --name my-project shell --kit ./my-mixin/ + + # Create from a template that already exists in the cloud registry + sbx --cloud create -t TEMPLATE see_also: - sbx create - Create a sandbox for an agent diff --git a/data/sbx_cli/sbx_daemon.yaml b/data/sbx_cli/sbx_daemon.yaml index 51ea11582b..308e186162 100644 --- a/data/sbx_cli/sbx_daemon.yaml +++ b/data/sbx_cli/sbx_daemon.yaml @@ -11,10 +11,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_daemon_log-level.yaml b/data/sbx_cli/sbx_daemon_log-level.yaml index f8c02ebd35..6f88b11602 100644 --- a/data/sbx_cli/sbx_daemon_log-level.yaml +++ b/data/sbx_cli/sbx_daemon_log-level.yaml @@ -11,10 +11,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_daemon_log-level_set.yaml b/data/sbx_cli/sbx_daemon_log-level_set.yaml index dd682e59e9..25b8bc1b62 100644 --- a/data/sbx_cli/sbx_daemon_log-level_set.yaml +++ b/data/sbx_cli/sbx_daemon_log-level_set.yaml @@ -11,10 +11,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_daemon_restart.yaml b/data/sbx_cli/sbx_daemon_restart.yaml index 92ba784a57..cd0cc36655 100644 --- a/data/sbx_cli/sbx_daemon_restart.yaml +++ b/data/sbx_cli/sbx_daemon_restart.yaml @@ -11,10 +11,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_daemon_start.yaml b/data/sbx_cli/sbx_daemon_start.yaml index 9867c64612..14ad142a31 100644 --- a/data/sbx_cli/sbx_daemon_start.yaml +++ b/data/sbx_cli/sbx_daemon_start.yaml @@ -18,10 +18,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_daemon_status.yaml b/data/sbx_cli/sbx_daemon_status.yaml index 57f920ad2d..f5948bc69e 100644 --- a/data/sbx_cli/sbx_daemon_status.yaml +++ b/data/sbx_cli/sbx_daemon_status.yaml @@ -14,10 +14,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_daemon_stop.yaml b/data/sbx_cli/sbx_daemon_stop.yaml index c22253b0f9..ae375a0662 100644 --- a/data/sbx_cli/sbx_daemon_stop.yaml +++ b/data/sbx_cli/sbx_daemon_stop.yaml @@ -11,10 +11,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_diagnose.yaml b/data/sbx_cli/sbx_diagnose.yaml index 0742f6dba8..3a1b7c4ff2 100644 --- a/data/sbx_cli/sbx_diagnose.yaml +++ b/data/sbx_cli/sbx_diagnose.yaml @@ -20,10 +20,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_env.yaml b/data/sbx_cli/sbx_env.yaml index 139df5db74..4eaf08fa33 100644 --- a/data/sbx_cli/sbx_env.yaml +++ b/data/sbx_cli/sbx_env.yaml @@ -2,7 +2,7 @@ name: sbx env synopsis: | Manage sandboxes declaratively from an sbxenv.yaml file experimental: true -description: |- +description: | Manage a sandbox environment declared in an sbxenv.yaml file. The file describes the agent, optional mixin kits, workspace mounts, @@ -10,6 +10,16 @@ description: |- bindings. Secrets are provisioned at the environment's sandbox scope so `sbx env rm` can remove everything it created. + A secret with `command` or `ref` can set `snapshot: true` to resolve on + the host after approval and store the result as a literal. This works locally + and with --cloud. Snapshots do not refresh; recreate the environment to rotate + them. A snapshot cannot set refresh or noVerify. + + secrets: + github: + command: gh auth token + snapshot: true + A file may declare its own inputs in an `args:` block, each with a default or `required: true` and an optional description, enum, or pattern. Reference one as `${{ env.args.NAME }}` anywhere a value appears and supply it with @@ -150,6 +160,53 @@ description: |- environment's commands are your own and run many times a day, "sbx settings set env.rememberHostCommands true" asks about them only when they change. + + With --cloud, create, run, exec, rm and plan manage a cloud sandbox from the same + file. Supported declarations are agents and kits, sandbox environment variables, + CPU and memory sizing, literal or snapshot secrets and bindings for supported providers, and + host lifecycle commands. Kits can publish TCP ports through cloud endpoints. + Stored cloud secrets are inherited as with cloud create/run; sandbox-scoped secrets + override account defaults, and secrets declared in the file override both. The plan + shows inherited credentials. Removal deletes only secrets provisioned by this environment. + + Bindings merge into the same global credentials.yaml as local environments and + are retained on removal unless --prune-bindings is passed. Cloud must advertise + kit credential support. Third-party kit domains must be approved by the binding; + creation refuses implicit provider-default routing for a bound secret. Bindings + and secrets are provisioned at creation; editing them requires recreating the sandbox. + + Snapshot references use the host's supported CLI resolvers (such as op:// and AWS + Secrets Manager ARNs); the sdk backend is unsupported. An interrupted secret + upload reuses the saved value in the host credential store. If that value is + unavailable, resolution is not repeated: follow the recovery error before cleanup. + + workspace, additionalWorkspaces and clone name host directories, which a cloud + sandbox cannot mount; remove them and clone the project inside the sandbox from a + kit instead. Host port bindings, registry credentials, MCP definitions, custom + credential providers, local sandbox options and dynamic secret sources are also + rejected before host commands or provisioning. Initialize commands may prepare + local kit sources; kit validation follows initialization and precedes cloud baking. + + State belongs to this machine, the selected cloud endpoint, Docker identity and + ordered environment files. Use the same target and files for subsequent commands. + DOCKER_ACCESS_TOKEN uses a token-specific state scope: changing the token starts + with separate state. Use sbx login for state that survives token refresh. + + If creation is interrupted, retry the same command and declaration within 23 hours. + Removal waits for unresolved writes to be recovered. Older unresolved attempts + retain their journal; the error names its path. Before deleting that journal, + confirm the original requests have finished and remove their sandbox and secrets + using ordinary cloud commands in the same account and endpoint. If the outcome + cannot be confirmed, retain the journal and contact support. + + Lifecycle commands inherit the cloud endpoint and expose SBX_SANDBOX_ID after + creation. Sandbox env values apply to new sessions; rejoining a live agent keeps + that process's existing environment. + + sbx --cloud env plan ./sbxenv.yaml + sbx --cloud env run --auto-approve --detached ./sbxenv.yaml + sbx --cloud env exec ./sbxenv.yaml -- git status + sbx --cloud env rm --force ./sbxenv.yaml usage: sbx env COMMAND options: - name: help @@ -161,10 +218,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_env_create.yaml b/data/sbx_cli/sbx_env_create.yaml index a63bb0cd01..d853819bdb 100644 --- a/data/sbx_cli/sbx_env_create.yaml +++ b/data/sbx_cli/sbx_env_create.yaml @@ -75,10 +75,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_env_exec.yaml b/data/sbx_cli/sbx_env_exec.yaml index d2ea4ce7d1..36c7ee012c 100644 --- a/data/sbx_cli/sbx_env_exec.yaml +++ b/data/sbx_cli/sbx_env_exec.yaml @@ -37,7 +37,7 @@ options: - name: detach shorthand: d default_value: "false" - usage: 'Detached mode: run command in the background' + usage: Detached mode (not supported) - name: detach-keys usage: Override the key sequence for detaching a container - name: env @@ -86,10 +86,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_env_plan.yaml b/data/sbx_cli/sbx_env_plan.yaml index 4eddc20360..c133819239 100644 --- a/data/sbx_cli/sbx_env_plan.yaml +++ b/data/sbx_cli/sbx_env_plan.yaml @@ -76,10 +76,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_env_rm.yaml b/data/sbx_cli/sbx_env_rm.yaml index 413e20d75b..a465c8341c 100644 --- a/data/sbx_cli/sbx_env_rm.yaml +++ b/data/sbx_cli/sbx_env_rm.yaml @@ -66,10 +66,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_env_run.yaml b/data/sbx_cli/sbx_env_run.yaml index 9013c0a1c8..d20899b11d 100644 --- a/data/sbx_cli/sbx_env_run.yaml +++ b/data/sbx_cli/sbx_env_run.yaml @@ -80,10 +80,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_exec.yaml b/data/sbx_cli/sbx_exec.yaml index 5baae6abbb..c2f0809b49 100644 --- a/data/sbx_cli/sbx_exec.yaml +++ b/data/sbx_cli/sbx_exec.yaml @@ -4,7 +4,8 @@ description: |- Execute a command in a sandbox. If the sandbox is stopped, it is started first. Or — with --cloud — the cloud sandbox ID (sbx_*) or name from "sbx --cloud ls". - Flags match the behavior of "docker exec". Some flags (-d, --user, --privileged) + Flags match the behavior of "docker exec", except detached exec (-d/--detach) + is not supported. Some flags (-d, --user, --privileged) are not supported with --cloud and are rejected rather than silently ignored. --detach-keys applies only to an interactive (-i/-t) cloud exec. usage: sbx exec [flags] SANDBOX COMMAND [ARG...] @@ -12,7 +13,7 @@ options: - name: detach shorthand: d default_value: "false" - usage: 'Detached mode: run command in the background' + usage: Detached mode (not supported) - name: detach-keys usage: Override the key sequence for detaching a container - name: env @@ -48,10 +49,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -60,9 +57,6 @@ example: |4- # Open a shell inside a sandbox sbx exec -it my-sandbox bash - # Run a command in the background - sbx exec -d my-sandbox npm start - # Run as root sbx exec -u root my-sandbox apt-get update diff --git a/data/sbx_cli/sbx_kit.yaml b/data/sbx_cli/sbx_kit.yaml index 1b0c41ac71..c3936b7024 100644 --- a/data/sbx_cli/sbx_kit.yaml +++ b/data/sbx_cli/sbx_kit.yaml @@ -18,10 +18,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -29,6 +25,7 @@ inherited_options: see_also: - sbx - Manage AI coding agent sandboxes. - sbx kit add - Add a mixin to a sandbox + - sbx kit builder - Manage the kit builder sandbox - sbx kit inspect - Display details about a kit artifact - sbx kit pack - Package a directory as a kit artifact - sbx kit provenance - Show the SLSA provenance attached to a kit diff --git a/data/sbx_cli/sbx_kit_add.yaml b/data/sbx_cli/sbx_kit_add.yaml index e3a676eed3..4a300e367a 100644 --- a/data/sbx_cli/sbx_kit_add.yaml +++ b/data/sbx_cli/sbx_kit_add.yaml @@ -37,10 +37,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_builder.yaml b/data/sbx_cli/sbx_kit_builder.yaml new file mode 100644 index 0000000000..6182fa08ba --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder.yaml @@ -0,0 +1,31 @@ +name: sbx kit builder +synopsis: Manage the kit builder sandbox +experimental: true +description: |- + Manage the kit builder sandbox. + + Source-form kit builds (a local directory or git reference) run inside a + shared builder sandbox named sbx-kit-builder, created on first + use. Its Docker engine store doubles as the kit build cache, so removing + the builder is how the cache is reclaimed; the next source-form build + recreates it. +usage: sbx kit builder COMMAND +options: + - name: help + shorthand: h + default_value: "false" + usage: help for builder +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit - (Experimental) Manage kit artifacts + - sbx kit builder history - Inspect kit build history in the builder sandbox + - sbx kit builder rm - Remove the kit builder sandbox and its build cache + - sbx kit builder status - Show the kit builder sandbox and build-cache state diff --git a/data/sbx_cli/sbx_kit_builder_history.yaml b/data/sbx_cli/sbx_kit_builder_history.yaml new file mode 100644 index 0000000000..fa2370b300 --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_history.yaml @@ -0,0 +1,32 @@ +name: sbx kit builder history +synopsis: Inspect kit build history in the builder sandbox +experimental: true +description: |- + Inspect kit build history in the builder sandbox. + + Each subcommand runs the matching docker buildx history command inside + the builder sandbox, against the buildx instance kit builds use. Flags + and arguments pass through verbatim. +usage: sbx kit builder history COMMAND +options: + - name: help + shorthand: h + default_value: "false" + usage: help for history +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder - Manage the kit builder sandbox + - sbx kit builder history export - Export a kit build record into a bundle + - sbx kit builder history inspect - Inspect a kit build record + - sbx kit builder history logs - Print a kit build's logs + - sbx kit builder history ls - List kit build records + - sbx kit builder history rm - Remove kit build records + - sbx kit builder history trace - Show the execution trace of a kit build diff --git a/data/sbx_cli/sbx_kit_builder_history_export.yaml b/data/sbx_cli/sbx_kit_builder_history_export.yaml new file mode 100644 index 0000000000..bb5ffc5984 --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_history_export.yaml @@ -0,0 +1,20 @@ +name: sbx kit builder history export +synopsis: Export a kit build record into a bundle +experimental: true +usage: sbx kit builder history export [ARGS...] [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for export +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder history - Inspect kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history_inspect.yaml b/data/sbx_cli/sbx_kit_builder_history_inspect.yaml new file mode 100644 index 0000000000..9202c8b2bb --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_history_inspect.yaml @@ -0,0 +1,20 @@ +name: sbx kit builder history inspect +synopsis: Inspect a kit build record +experimental: true +usage: sbx kit builder history inspect [ARGS...] [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for inspect +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder history - Inspect kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history_logs.yaml b/data/sbx_cli/sbx_kit_builder_history_logs.yaml new file mode 100644 index 0000000000..aaf71b2c86 --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_history_logs.yaml @@ -0,0 +1,20 @@ +name: sbx kit builder history logs +synopsis: Print a kit build's logs +experimental: true +usage: sbx kit builder history logs [ARGS...] [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for logs +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder history - Inspect kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history_ls.yaml b/data/sbx_cli/sbx_kit_builder_history_ls.yaml new file mode 100644 index 0000000000..965a762e8b --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_history_ls.yaml @@ -0,0 +1,20 @@ +name: sbx kit builder history ls +synopsis: List kit build records +experimental: true +usage: sbx kit builder history ls [ARGS...] [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for ls +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder history - Inspect kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history_rm.yaml b/data/sbx_cli/sbx_kit_builder_history_rm.yaml new file mode 100644 index 0000000000..5c1f4d8450 --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_history_rm.yaml @@ -0,0 +1,25 @@ +name: sbx kit builder history rm +synopsis: Remove kit build records +experimental: true +usage: sbx kit builder history rm [ARGS...] [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for rm + - name: "yes" + shorthand: "y" + default_value: "false" + usage: | + Skip confirmation prompt (buildx --force still controls running build records) +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder history - Inspect kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_history_trace.yaml b/data/sbx_cli/sbx_kit_builder_history_trace.yaml new file mode 100644 index 0000000000..8105ee4089 --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_history_trace.yaml @@ -0,0 +1,20 @@ +name: sbx kit builder history trace +synopsis: Show the execution trace of a kit build +experimental: true +usage: sbx kit builder history trace [ARGS...] [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for trace +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder history - Inspect kit build history in the builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_rm.yaml b/data/sbx_cli/sbx_kit_builder_rm.yaml new file mode 100644 index 0000000000..9391756aab --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_rm.yaml @@ -0,0 +1,24 @@ +name: sbx kit builder rm +synopsis: Remove the kit builder sandbox and its build cache +experimental: true +usage: sbx kit builder rm [flags] +options: + - name: force + shorthand: f + default_value: "false" + usage: Skip confirmation prompts and delete even if in use + - name: help + shorthand: h + default_value: "false" + usage: help for rm +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder - Manage the kit builder sandbox diff --git a/data/sbx_cli/sbx_kit_builder_status.yaml b/data/sbx_cli/sbx_kit_builder_status.yaml new file mode 100644 index 0000000000..36101271e1 --- /dev/null +++ b/data/sbx_cli/sbx_kit_builder_status.yaml @@ -0,0 +1,20 @@ +name: sbx kit builder status +synopsis: Show the kit builder sandbox and build-cache state +experimental: true +usage: sbx kit builder status [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for status +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx kit builder - Manage the kit builder sandbox diff --git a/data/sbx_cli/sbx_kit_inspect.yaml b/data/sbx_cli/sbx_kit_inspect.yaml index 434246bd72..c04aaadb54 100644 --- a/data/sbx_cli/sbx_kit_inspect.yaml +++ b/data/sbx_cli/sbx_kit_inspect.yaml @@ -32,10 +32,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_pack.yaml b/data/sbx_cli/sbx_kit_pack.yaml index f2282d7c9d..7ddc4ccaba 100644 --- a/data/sbx_cli/sbx_kit_pack.yaml +++ b/data/sbx_cli/sbx_kit_pack.yaml @@ -19,10 +19,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_provenance.yaml b/data/sbx_cli/sbx_kit_provenance.yaml index e22e26df95..b7403efb3d 100644 --- a/data/sbx_cli/sbx_kit_provenance.yaml +++ b/data/sbx_cli/sbx_kit_provenance.yaml @@ -43,10 +43,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_pull.yaml b/data/sbx_cli/sbx_kit_pull.yaml index e8eb2e6be2..b863eb3158 100644 --- a/data/sbx_cli/sbx_kit_pull.yaml +++ b/data/sbx_cli/sbx_kit_pull.yaml @@ -28,10 +28,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_push.yaml b/data/sbx_cli/sbx_kit_push.yaml index 03b37ad271..145eca0845 100644 --- a/data/sbx_cli/sbx_kit_push.yaml +++ b/data/sbx_cli/sbx_kit_push.yaml @@ -55,10 +55,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_sign.yaml b/data/sbx_cli/sbx_kit_sign.yaml index 2ddd5f9a76..5a5c3f1569 100644 --- a/data/sbx_cli/sbx_kit_sign.yaml +++ b/data/sbx_cli/sbx_kit_sign.yaml @@ -49,10 +49,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_validate.yaml b/data/sbx_cli/sbx_kit_validate.yaml index 754730a745..4299fd819f 100644 --- a/data/sbx_cli/sbx_kit_validate.yaml +++ b/data/sbx_cli/sbx_kit_validate.yaml @@ -33,10 +33,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_kit_verify.yaml b/data/sbx_cli/sbx_kit_verify.yaml index 89f66cf7c4..6e05822cd8 100644 --- a/data/sbx_cli/sbx_kit_verify.yaml +++ b/data/sbx_cli/sbx_kit_verify.yaml @@ -47,10 +47,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_login.yaml b/data/sbx_cli/sbx_login.yaml index e505c20238..59a583d87f 100644 --- a/data/sbx_cli/sbx_login.yaml +++ b/data/sbx_cli/sbx_login.yaml @@ -16,10 +16,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_logout.yaml b/data/sbx_cli/sbx_logout.yaml index 6493703aa3..b87319a5dd 100644 --- a/data/sbx_cli/sbx_logout.yaml +++ b/data/sbx_cli/sbx_logout.yaml @@ -1,5 +1,5 @@ name: sbx logout -synopsis: Stop all running sandboxes and sign out of Docker +synopsis: Stop running local sandboxes and sign out of Docker usage: sbx logout [flags] options: - name: help @@ -15,10 +15,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_ls.yaml b/data/sbx_cli/sbx_ls.yaml index e97011bdaf..9e0a201c05 100644 --- a/data/sbx_cli/sbx_ls.yaml +++ b/data/sbx_cli/sbx_ls.yaml @@ -20,10 +20,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_mcp.yaml b/data/sbx_cli/sbx_mcp.yaml index ed35f2b6c4..4bea6f3632 100644 --- a/data/sbx_cli/sbx_mcp.yaml +++ b/data/sbx_cli/sbx_mcp.yaml @@ -13,10 +13,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -27,5 +23,5 @@ see_also: - sbx mcp auth - Authorize MCP servers - sbx mcp inspect - Show MCP server details - sbx mcp load - Load an already-registered MCP server into a running sandbox - - sbx mcp ls - List MCP servers, grouped by the gateway that serves them + - sbx mcp ls - List MCP servers - sbx mcp rm - Remove a registered MCP server diff --git a/data/sbx_cli/sbx_mcp_add.yaml b/data/sbx_cli/sbx_mcp_add.yaml index 73d59c5e31..fa784bf2d8 100644 --- a/data/sbx_cli/sbx_mcp_add.yaml +++ b/data/sbx_cli/sbx_mcp_add.yaml @@ -32,10 +32,11 @@ description: |- legitimate servers live on private networks (split-horizon DNS, internal load balancers, VPN-only endpoints, PrivateLink), so their public hostname resolves to a private address and the warning is expected noise for them. - OAuth authorization-server metadata has a separate SSRF guard that blocks - disallowed addresses. Pass --skip-ssrf-check to disable both checks for this - add, including OAuth metadata redirects, when you trust the provider and - its discovery destinations; use it only for URLs you control. + OAuth authorization-server metadata has a separate SSRF guard with the same + warn-and-proceed posture: a disallowed address is logged, not blocked. Pass + --skip-ssrf-check to disable both checks for this add, including OAuth + metadata redirects (silencing the warning too), when you trust the provider + and its discovery destinations; use it only for URLs you control. OAuth for remote endpoints (--oauth-authorization-server / --client-id): Two related options configure OAuth for a remote --url server (both are @@ -226,6 +227,10 @@ options: usage: Executable to run for a local stdio server - name: dir usage: Working directory (cwd) for a --command host server + - name: disable-http2 + default_value: "false" + usage: | + Do not negotiate HTTP/2 for this remote server, leaving HTTP/1.1. Applies to --url servers. - name: header default_value: '[]' usage: | @@ -267,10 +272,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_mcp_auth.yaml b/data/sbx_cli/sbx_mcp_auth.yaml index 96aabe4656..42761f9874 100644 --- a/data/sbx_cli/sbx_mcp_auth.yaml +++ b/data/sbx_cli/sbx_mcp_auth.yaml @@ -9,10 +9,7 @@ description: |- Running 'sbx mcp auth ' authorizes or reauthorizes one server. If the stored credential is expired, sbx asks the control plane to refresh it first and - only falls back to interactive OAuth when refresh needs user consent. A name - with no local registration is resolved from the Docker MCP catalog and - authorized under its catalog name, so no 'sbx mcp add' is required for catalog - servers. + only falls back to interactive OAuth when refresh needs user consent. Use 'sbx mcp auth status' to inspect hosted credential status without starting OAuth, and 'sbx mcp auth rm' to remove hosted credentials without removing @@ -78,10 +75,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_mcp_auth_rm.yaml b/data/sbx_cli/sbx_mcp_auth_rm.yaml index 49c6c2186f..9a839d21d6 100644 --- a/data/sbx_cli/sbx_mcp_auth_rm.yaml +++ b/data/sbx_cli/sbx_mcp_auth_rm.yaml @@ -10,6 +10,10 @@ options: - name: all default_value: "false" usage: Apply to all registered OAuth servers + - name: force + shorthand: f + default_value: "false" + usage: Skip confirmation prompts - name: format default_value: text usage: 'Output format: "text" or "json"' @@ -25,10 +29,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_mcp_auth_status.yaml b/data/sbx_cli/sbx_mcp_auth_status.yaml index 434b7aeb81..20c19dfc53 100644 --- a/data/sbx_cli/sbx_mcp_auth_status.yaml +++ b/data/sbx_cli/sbx_mcp_auth_status.yaml @@ -24,10 +24,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_mcp_inspect.yaml b/data/sbx_cli/sbx_mcp_inspect.yaml index ee151f1b26..dde694a77b 100644 --- a/data/sbx_cli/sbx_mcp_inspect.yaml +++ b/data/sbx_cli/sbx_mcp_inspect.yaml @@ -14,10 +14,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_mcp_load.yaml b/data/sbx_cli/sbx_mcp_load.yaml index 4f5c33ddf9..6b108bb4e1 100644 --- a/data/sbx_cli/sbx_mcp_load.yaml +++ b/data/sbx_cli/sbx_mcp_load.yaml @@ -7,6 +7,13 @@ description: |- The server must already exist in the local MCP store (register first with 'sbx mcp add'). Both remote/hosted and local-stdio servers are supported. + + With --cloud: + Load an MCP server into a running cloud sandbox's gateway. + + There is no local registration: the cloud gateway resolves the server name + itself, and the sandbox may be given by name or sbx_ ID. Connected agents see + the new server's tools immediately. usage: sbx mcp load --sandbox [flags] options: - name: help @@ -20,10 +27,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -36,5 +39,8 @@ example: |4- # Local stdio server. sbx mcp add github --command npx --args @modelcontextprotocol/server-github sbx mcp load github --sandbox my-sbx + + # Cloud: load a gateway-known server into a cloud sandbox by name or ID + sbx --cloud mcp load notion --sandbox my-sbx see_also: - sbx mcp - Manage MCP servers diff --git a/data/sbx_cli/sbx_mcp_ls.yaml b/data/sbx_cli/sbx_mcp_ls.yaml index 148f456d0e..a9b8d490c4 100644 --- a/data/sbx_cli/sbx_mcp_ls.yaml +++ b/data/sbx_cli/sbx_mcp_ls.yaml @@ -1,10 +1,10 @@ name: sbx mcp ls -synopsis: List MCP servers, grouped by the gateway that serves them +synopsis: List MCP servers description: |- List registered MCP servers under the gateway that serves them. - The gateway header reports where it runs, who controls it, and whether you are - signed in; each server row reports its transport and whether it is usable now. + The GATEWAY column reports where each server runs, who controls it, and the + signed-in identity; each row also reports its transport and whether it is usable now. Servers needing authorization carry the 'sbx mcp auth' next step. A server registered with custom headers is marked as such; one whose header @@ -15,6 +15,15 @@ description: |- Auth status is read without starting an OAuth flow — from the local token store in local data-plane mode, otherwise from the hosted control plane. + + With --cloud: + List MCP servers reported by existing cloud sandbox gateways, with the + sandboxes that reference each server. Servers skipped by a gateway are excluded. + This is not a complete inventory of configured servers: unused configurations + and gateways that do not report server names are absent, including with --quiet. + + Specify a sandbox to show its gateway state and host, requested servers, and + skipped servers. usage: sbx mcp ls [flags] options: - name: help @@ -24,15 +33,15 @@ options: - name: json default_value: "false" usage: Output in JSON format + - name: quiet + shorthand: q + default_value: "false" + usage: Only display MCP server names inherited_options: - name: cloud default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -42,5 +51,11 @@ example: |4- # Machine-readable output for scripting sbx mcp ls --json + + # Cloud: list servers reported across existing sandboxes + sbx --cloud mcp ls + + # Cloud: show a cloud sandbox's gateway by name or sbx_ ID + sbx --cloud mcp ls my-sbx see_also: - sbx mcp - Manage MCP servers diff --git a/data/sbx_cli/sbx_mcp_rm.yaml b/data/sbx_cli/sbx_mcp_rm.yaml index 47dbc82401..34df94ee96 100644 --- a/data/sbx_cli/sbx_mcp_rm.yaml +++ b/data/sbx_cli/sbx_mcp_rm.yaml @@ -2,6 +2,10 @@ name: sbx mcp rm synopsis: Remove a registered MCP server usage: sbx mcp rm [flags] options: + - name: force + shorthand: f + default_value: "false" + usage: Skip confirmation prompts - name: help shorthand: h default_value: "false" @@ -11,10 +15,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy.yaml b/data/sbx_cli/sbx_policy.yaml index 8e1c55756c..076f4bed2d 100644 --- a/data/sbx_cli/sbx_policy.yaml +++ b/data/sbx_cli/sbx_policy.yaml @@ -17,10 +17,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_allow.yaml b/data/sbx_cli/sbx_policy_allow.yaml index 6c84f008a8..a28c0aa4cc 100644 --- a/data/sbx_cli/sbx_policy_allow.yaml +++ b/data/sbx_cli/sbx_policy_allow.yaml @@ -17,10 +17,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_allow_network.yaml b/data/sbx_cli/sbx_policy_allow_network.yaml index c27cbe6103..bf6af7e762 100644 --- a/data/sbx_cli/sbx_policy_allow_network.yaml +++ b/data/sbx_cli/sbx_policy_allow_network.yaml @@ -3,9 +3,16 @@ synopsis: Allow network access to specified hosts description: |- Allow sandbox network access to the specified hosts. - RESOURCES is a comma-separated list of hostnames, domains, or IP addresses. - Supports exact domains (example.com), wildcard subdomains (*.example.com), - and optional port suffixes (example.com:443). Use "**" to allow all hosts. + RESOURCES is a comma-separated list of hostnames, domains, IP addresses, or + CIDR prefixes. Rules apply to TCP by default; use --protocol to select UDP or + both transports. Supports exact domains (example.com), wildcard subdomains + (*.example.com), multi-label wildcards (**.example.com), single-character + globs (api?.example.com), character classes (api[12].example.com, + api[!1].example.com), and optional port suffixes (example.com:443). An IPv6 + address takes a port in brackets ([2001:db8::1]:443) or a CIDR prefix + (2001:db8::1/128); a bare one is refused. Use "**" to allow all hosts. A bare + "*", an escaped glob character such as "\*", and any other pattern outside + these forms are rejected rather than stored as a rule that matches nothing. The rule applies globally to all sandboxes by default. Use --sandbox to add the rule to policy "local" scoped to a single sandbox instead. @@ -15,6 +22,9 @@ options: shorthand: h default_value: "false" usage: help for network + - name: protocol + usage: | + Network protocol: tcp or udp; repeat or comma-separate for both - name: sandbox usage: | Scope the rule to a specific sandbox (default: all sandboxes) @@ -23,10 +33,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -44,7 +50,7 @@ example: |4- # Allow all subdomains of a host sbx policy allow network "*.npmjs.org" - # Allow all outbound traffic - sbx policy allow network "**" + # Allow all outbound traffic on both transports + sbx policy allow network --protocol tcp,udp "**" see_also: - sbx policy allow - Add an allow rule for sandboxes diff --git a/data/sbx_cli/sbx_policy_check.yaml b/data/sbx_cli/sbx_policy_check.yaml index 37c9620bf4..186da045c3 100644 --- a/data/sbx_cli/sbx_policy_check.yaml +++ b/data/sbx_cli/sbx_policy_check.yaml @@ -16,10 +16,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_check_network.yaml b/data/sbx_cli/sbx_policy_check_network.yaml index 29a244057b..3d5c32852a 100644 --- a/data/sbx_cli/sbx_policy_check_network.yaml +++ b/data/sbx_cli/sbx_policy_check_network.yaml @@ -5,7 +5,8 @@ description: |- TARGET may be a hostname, host:port, IP literal, or URL. Bare hosts and IP literals are evaluated with port 443. HTTP(S) URLs use their default ports; - other URL schemes must include an explicit port. + other URL schemes must include an explicit port. URLs supply only their host + and port: this command evaluates network authorization, not HTTP method or path. usage: sbx policy check network [--sandbox SANDBOX] TARGET [flags] options: - name: help @@ -15,6 +16,8 @@ options: - name: json default_value: "false" usage: Output in JSON format + - name: protocol + usage: 'Network protocol to evaluate: tcp or udp' - name: sandbox usage: Evaluate in a specific sandbox policy context - name: verbose @@ -25,10 +28,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_deny.yaml b/data/sbx_cli/sbx_policy_deny.yaml index bd44b2c3df..a9a72cd87b 100644 --- a/data/sbx_cli/sbx_policy_deny.yaml +++ b/data/sbx_cli/sbx_policy_deny.yaml @@ -16,10 +16,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_deny_network.yaml b/data/sbx_cli/sbx_policy_deny_network.yaml index 4c3bd7098d..558a9bd6b1 100644 --- a/data/sbx_cli/sbx_policy_deny_network.yaml +++ b/data/sbx_cli/sbx_policy_deny_network.yaml @@ -3,9 +3,12 @@ synopsis: Deny network access to specified hosts description: |- Block sandbox network access to the specified hosts. - RESOURCES is a comma-separated list of hostnames, domains, or IP addresses. - Deny rules take precedence over allow rules for the same hostname or CIDR. An - allowed hostname isn't checked against CIDR rules for its resolved IP address. + RESOURCES takes the same forms as "sbx policy allow network": exact domains, + wildcard subdomains, IP addresses, and CIDR prefixes, with optional port + suffixes. Rules apply to TCP and UDP by default; use --protocol to restrict a + rule to one transport. Deny rules take precedence over allow rules for the + same hostname or CIDR. An allowed hostname isn't checked against CIDR rules + for its resolved IP address. The rule applies globally to all sandboxes by default. Use --sandbox to add the rule to policy "local" scoped to a single sandbox instead. @@ -15,6 +18,9 @@ options: shorthand: h default_value: "false" usage: help for network + - name: protocol + usage: | + Restrict the rule to one protocol: tcp or udp (default tcp,udp) - name: sandbox usage: | Scope the rule to a specific sandbox (default: all sandboxes) @@ -23,10 +29,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -38,7 +40,10 @@ example: |4- # Block a host only for a specific sandbox sbx policy deny network --sandbox my-sandbox ads.example.com - # Block all outbound traffic + # Block all outbound traffic, TCP and UDP sbx policy deny network "**" + + # Block only UDP to a host + sbx policy deny network --protocol udp media.example.com see_also: - sbx policy deny - Add a deny rule for sandboxes diff --git a/data/sbx_cli/sbx_policy_init.yaml b/data/sbx_cli/sbx_policy_init.yaml index f453d58c08..ae02b55dc2 100644 --- a/data/sbx_cli/sbx_policy_init.yaml +++ b/data/sbx_cli/sbx_policy_init.yaml @@ -18,6 +18,14 @@ description: |- After initializing, use "sbx policy allow/deny/rm" to change the global policy. Use "sbx policy reset" to clear all policies and start over. + + With --cloud: + Set the default network mode of the cloud policy. + + There is no one-time setup: init sets the default mode for the account, or for + one sandbox with --sandbox, keeps the existing allow and deny rules, and can be + run again. balanced is deny-all plus the balanced allow list added to the scope. + Use "sbx --cloud policy reset" to clear the rules first. usage: sbx policy init [flags] options: - name: help @@ -31,10 +39,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -49,5 +53,11 @@ example: |4- # Block everything, then allow specific sites sbx policy init deny-all sbx policy allow network api.example.com:443 + + # Set the account default to balanced + sbx --cloud policy init balanced + + # Block everything for one sandbox, keeping its allow rules + sbx --cloud policy init deny-all --sandbox my-sandbox see_also: - sbx policy - Manage sandbox policies diff --git a/data/sbx_cli/sbx_policy_inspect.yaml b/data/sbx_cli/sbx_policy_inspect.yaml index dfe012483e..a032db8848 100644 --- a/data/sbx_cli/sbx_policy_inspect.yaml +++ b/data/sbx_cli/sbx_policy_inspect.yaml @@ -25,10 +25,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_log.yaml b/data/sbx_cli/sbx_policy_log.yaml index fcae70d0ef..45880953ab 100644 --- a/data/sbx_cli/sbx_policy_log.yaml +++ b/data/sbx_cli/sbx_policy_log.yaml @@ -31,10 +31,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_ls.yaml b/data/sbx_cli/sbx_policy_ls.yaml index 4bc83efcdc..8c9a6390ac 100644 --- a/data/sbx_cli/sbx_policy_ls.yaml +++ b/data/sbx_cli/sbx_policy_ls.yaml @@ -18,6 +18,9 @@ description: |- rule. usage: sbx policy ls [SANDBOX] [flags] options: + - name: created-via + usage: | + Filter policies by how they were created: "default", "added", "provisioned", or "approval" - name: decision usage: 'Filter policies by decision: "allow" or "deny"' - name: help @@ -30,12 +33,14 @@ options: - name: json default_value: "false" usage: Output filtered policy rules as JSON + - name: protocol + usage: 'Filter network rules by protocol: tcp or udp' - name: source usage: 'Filter policies by source: "local", "org", or "kit"' - name: type default_value: all usage: | - Filter policies by type: "all", "network", or "filesystem" (default "all") + Filter policies by type: "all", "network", "filesystem" (default "all") - name: wide default_value: "false" usage: Show detailed rule-level output with rule IDs and resources @@ -44,10 +49,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -71,6 +72,9 @@ example: |4- # List organization policies that deny access sbx policy ls --source org --decision deny + # List persistent rules created from approval prompts + sbx policy ls --wide --created-via approval + # Include inactive rules hidden by remote governance sbx policy ls --include-inactive see_also: diff --git a/data/sbx_cli/sbx_policy_reset.yaml b/data/sbx_cli/sbx_policy_reset.yaml index d3557a585c..38352cbf5a 100644 --- a/data/sbx_cli/sbx_policy_reset.yaml +++ b/data/sbx_cli/sbx_policy_reset.yaml @@ -9,6 +9,10 @@ description: |- If sandboxes are currently running, they will be stopped when the daemon shuts down. You will be prompted for confirmation unless --force is used. + + With --cloud, deletes the custom cloud network policy for your account and + leaves the local daemon alone. You will be prompted for confirmation unless + --force is used. Afterwards the default the server now stores is printed. usage: sbx policy reset [flags] options: - name: force @@ -24,10 +28,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_rm.yaml b/data/sbx_cli/sbx_policy_rm.yaml index 458be51650..e0ac4d5cb1 100644 --- a/data/sbx_cli/sbx_policy_rm.yaml +++ b/data/sbx_cli/sbx_policy_rm.yaml @@ -12,10 +12,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_policy_rm_network.yaml b/data/sbx_cli/sbx_policy_rm_network.yaml index ce0360eb47..e472817bf3 100644 --- a/data/sbx_cli/sbx_policy_rm_network.yaml +++ b/data/sbx_cli/sbx_policy_rm_network.yaml @@ -12,9 +12,22 @@ description: |- remove from policy "local" scoped to a single sandbox instead. Use "sbx policy ls --wide" to see active rule IDs and resources, or - "sbx policy ls --json" for the raw filtered daemon response. + "sbx policy ls --json" for the filtered rules; network values are printed in + the form the CLI accepts back. + + With --cloud: + Remove a cloud network rule by pattern. + + Cloud rules have no IDs: --resource removes the pattern from both the allow + and deny lists, and the output names each list it was removed from. The rule + leaves the account policy by default; use --sandbox to scope the removal to one + sandbox. Use "sbx --cloud policy ls" to see the current rules. usage: sbx policy rm network [--sandbox SANDBOX] [flags] options: + - name: force + shorthand: f + default_value: "false" + usage: Skip confirmation prompts - name: help shorthand: h default_value: "false" @@ -31,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -51,5 +60,11 @@ example: |4- # Remove a sandbox-scoped rule by resource sbx policy rm network --sandbox my-sandbox --resource api.example.com + + # Remove a cloud rule by pattern, from the allow or deny list it is in + sbx --cloud policy rm network --resource api.example.com + + # Remove a pattern from one cloud sandbox's rules + sbx --cloud policy rm network --sandbox my-sandbox --resource api.example.com see_also: - sbx policy rm - Remove a policy rule diff --git a/data/sbx_cli/sbx_ports.yaml b/data/sbx_cli/sbx_ports.yaml index 09046eeb4b..fa7059ea65 100644 --- a/data/sbx_cli/sbx_ports.yaml +++ b/data/sbx_cli/sbx_ports.yaml @@ -24,9 +24,15 @@ description: |- published with that same default or as dual-stack tcp. Name the protocol to remove a tcp6 or udp mapping; anything left behind is reported. - In cloud mode (--cloud), the sandbox may be given by ID (sbx_*) or name, and - only the sandbox port number is accepted. The cloud control plane assigns a - publicly reachable URL for each exposed port. + With --cloud: + Manage the exposed ports of a cloud sandbox. + + List, publish, or unpublish ports on a cloud sandbox given by ID (sbx_*) or + name. Without --publish or --unpublish flags, lists the exposed ports. + + A port is the sandbox port number alone or with a /tcp suffix; UDP and host + bindings are refused. The cloud control plane assigns a publicly reachable URL + for each exposed port. usage: sbx ports SANDBOX [flags] options: - name: help @@ -39,20 +45,16 @@ options: - name: publish default_value: '[]' usage: | - Publish a port (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT (cloud) + Publish a port (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT[/tcp] (cloud) - name: unpublish default_value: '[]' usage: | - Unpublish a port (can be repeated): [HOST_IP:]HOST_PORT:SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT (cloud) + Unpublish a port (can be repeated): [HOST_IP:]HOST_PORT:SANDBOX_PORT[/PROTOCOL] (local) or SANDBOX_PORT[/tcp] (cloud) inherited_options: - name: cloud default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -71,9 +73,9 @@ example: |4- sbx ports my-sandbox --unpublish 3000:8080 # Expose port 8080 on a cloud sandbox - sbx ports sbx_abc123 --cloud --publish 8080 + sbx --cloud ports sbx_abc123 --publish 8080 # Remove an exposed port from a cloud sandbox - sbx ports sbx_abc123 --cloud --unpublish 8080 + sbx --cloud ports sbx_abc123 --unpublish 8080 see_also: - sbx - Manage AI coding agent sandboxes. diff --git a/data/sbx_cli/sbx_prune.yaml b/data/sbx_cli/sbx_prune.yaml index efb4acf162..41f21650d8 100644 --- a/data/sbx_cli/sbx_prune.yaml +++ b/data/sbx_cli/sbx_prune.yaml @@ -51,10 +51,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_reset.yaml b/data/sbx_cli/sbx_reset.yaml index a90bd4893e..d7c4aaed85 100644 --- a/data/sbx_cli/sbx_reset.yaml +++ b/data/sbx_cli/sbx_reset.yaml @@ -42,10 +42,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_rm.yaml b/data/sbx_cli/sbx_rm.yaml index bd904faf13..f50e0be49b 100644 --- a/data/sbx_cli/sbx_rm.yaml +++ b/data/sbx_cli/sbx_rm.yaml @@ -7,7 +7,10 @@ description: |- For local sandboxes, stops them, removes their containers, cleans up any Git worktrees, deletes sandbox state, and deletes secrets scoped to each removed sandbox. This action cannot be undone. With --cloud, deletes - the sandbox in Docker Sandboxes Cloud. This action cannot be undone. + the sandbox in Docker Sandboxes Cloud. This action cannot be undone. Once the + server accepts the request, rm waits up to 60 seconds per sandbox for the + deletion. A removal still completing after that exits 0. Verify it later with + "sbx --cloud ls". Removal requires confirmation; use --force to skip confirmation prompts (for non-interactive scripts) and to delete a sandbox that is in use @@ -34,10 +37,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_run.yaml b/data/sbx_cli/sbx_run.yaml index 8fe874aefc..c72c0169b7 100644 --- a/data/sbx_cli/sbx_run.yaml +++ b/data/sbx_cli/sbx_run.yaml @@ -23,22 +23,34 @@ description: |- pass --detached (-d) to print the sandbox ID and exit without opening an interactive session. - With --cloud: the agent runs in the cloud sandbox image (started server-side). - Running an agent that has existing sandboxes (running or stopped) prompts you - to pick one to reuse or to create a new one. Pass --new to skip the prompt and - always create a fresh sandbox. --detached also skips the prompt and always - creates a new sandbox; a non-interactive run without --detached is refused. - Use --detached for non-interactive scripting (e.g. - sbx --cloud run -d claude && sbx --cloud exec ...). - Without --cpus/--memory a cloud sandbox defaults to 2 CPUs and 4 GiB. - Templates referenced via -t / --template must already exist in the cloud registry; - the CLI does not upload them automatically. See https://docs.docker.com/ai/sandboxes/ for the cloud sandbox model. - Available agents: claude, codex, copilot, cursor, devin, docker-agent, droid, gemini, kiro, opencode, shell + + With --cloud: + Run an agent in a cloud sandbox, creating the sandbox if it does not already exist. + + The first positional argument identifies the agent to run: a built-in agent + name or a sandbox kit reference (a local directory, ZIP file, git repository, + or OCI reference). Relative local references must be explicit paths such as + ./my-kit or ../my-kit.zip. Cloud sandboxes have no host workspace, so no path + follows the agent. Pass agent arguments after the "--" separator. + + Running an agent that has existing sandboxes, running or stopped, prompts you + to pick one to reuse or to create a new one. Pass --new to skip the prompt and + always create a fresh sandbox. --name NAME reuses and restarts the sandbox of + that name when it exists and creates it otherwise. A launch that bakes a kit + template (a sandbox kit or a mixin with build content) always creates fresh. + --detached skips the prompt: with --name it restarts that sandbox when it + exists, otherwise it creates a new one. A non-interactive run without + --detached is refused, so scripts pass --detached (e.g. + sbx --cloud run -d claude && sbx --cloud exec ...). + + Sizing comes from --cpus and --memory and must land on a billable shape; without + them a cloud sandbox gets 2 CPUs and 4 GiB. A template named with -t / --template + must already exist in the cloud registry; the CLI does not upload it. See + https://docs.docker.com/ai/sandboxes/ for the cloud sandbox model. usage: sbx run [flags] [AGENT|SANDBOX_KIT] [PATH...] [-- AGENT_ARGS...] options: - name: allow-network - default_value: '[]' usage: | Network pattern to allow for cloud sandbox egress (cloud only; can be specified multiple times) - name: clone @@ -50,12 +62,16 @@ options: usage: | Number of CPUs to allocate to the sandbox (0 = auto: all host CPUs) - name: deny-network - default_value: '[]' usage: | - Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with `sbx policy ls ` / `sbx policy rm network --sandbox --resource `. Safe under centralized governance because a local deny can only narrow, never widen, egress. + Add a per-sandbox network deny rule at creation time. Can be specified multiple times. The rule applies only to the new sandbox and can be listed or removed later with 'sbx policy ls ' or 'sbx policy rm network --sandbox --resource '. Safe under centralized governance because a local deny can only narrow, never widen, egress. - name: detach-keys usage: | - Override the detach gesture that leaves the agent running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only). + Override the detach gesture that leaves the session running (Docker-style, e.g. "ctrl-\", "ctrl-x,ctrl-d"). Default: Ctrl-\. Use this when the default collides with an agent's keymap (cloud only). + - name: detached + shorthand: d + default_value: "false" + usage: | + Start the sandbox and print its ID without opening an agent session - name: env shorthand: e default_value: '[]' @@ -105,6 +121,9 @@ options: default_value: '[]' usage: | Publish a sandbox port to the host (can be repeated): [[HOST_IP:]HOST_PORT:]SANDBOX_PORT[/PROTOCOL]. Applied when the sandbox is created; ignored when re-attaching (use "sbx ports") + - name: pull + default_value: always + usage: Image pull policy (always|missing|never) - name: skills usage: | Shared skills store mode: off, readonly, or readwrite (mounted at the agent's skills directory, e.g. ~/.claude/skills). Default: readonly, or the configured skills.defaultMode setting. Can only be used when creating a new sandbox. @@ -113,9 +132,8 @@ options: usage: | Container image to use for the sandbox (default: agent-specific image) - name: ttl - default_value: 0s usage: | - Cloud sandbox time-to-live before it times out (e.g. 30m, 2h; cloud only; default: server-side) + Cloud sandbox time-to-live before it times out (e.g. 30m, 2h, 1h30m; units are case-insensitive; cloud only; default: server-side) - name: volume shorthand: v default_value: '[]' @@ -127,10 +145,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -160,7 +174,16 @@ example: |4- # Run a sandbox with agent arguments sbx run claude -- --continue + # Run claude in a new cloud sandbox + sbx --cloud run claude + # Create a cloud sandbox non-interactively and print its ID sbx --cloud run --detached claude + + # Reuse the cloud sandbox of that name, creating it when it does not exist + sbx --cloud run --name my-project claude + + # Run with agent arguments + sbx --cloud run claude -- --continue see_also: - sbx - Manage AI coding agent sandboxes. diff --git a/data/sbx_cli/sbx_secret.yaml b/data/sbx_cli/sbx_secret.yaml index 6dcccd33c2..d4d11e1b0e 100644 --- a/data/sbx_cli/sbx_secret.yaml +++ b/data/sbx_cli/sbx_secret.yaml @@ -25,10 +25,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_secret_import.yaml b/data/sbx_cli/sbx_secret_import.yaml index 99f19ed455..2da741a363 100644 --- a/data/sbx_cli/sbx_secret_import.yaml +++ b/data/sbx_cli/sbx_secret_import.yaml @@ -43,10 +43,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_secret_ls.yaml b/data/sbx_cli/sbx_secret_ls.yaml index 2d38a513f1..e23f2921a8 100644 --- a/data/sbx_cli/sbx_secret_ls.yaml +++ b/data/sbx_cli/sbx_secret_ls.yaml @@ -18,6 +18,10 @@ options: - name: json default_value: "false" usage: Output in JSON format + - name: quiet + shorthand: q + default_value: "false" + usage: Only display secret names - name: sandbox usage: Only list secrets for one sandbox - name: service @@ -27,10 +31,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_secret_rm.yaml b/data/sbx_cli/sbx_secret_rm.yaml index 1d90eaa7a2..75211af4fb 100644 --- a/data/sbx_cli/sbx_secret_rm.yaml +++ b/data/sbx_cli/sbx_secret_rm.yaml @@ -20,21 +20,21 @@ options: - name: registry usage: Registry hostname to remove pull credentials for - name: sandbox - usage: 'Scope the removal to one sandbox (default: global)' + usage: | + Scope the removal to one sandbox (default: all scopes when choosing interactively, global with SERVICE) inherited_options: - name: cloud default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" usage: Enable debug logging example: |4- + # Choose an existing secret to remove with the arrow keys + sbx secret rm + # Remove a global secret sbx secret rm github @@ -60,5 +60,9 @@ example: |4- # Remove every stored secret across every scope (service secrets, custom # secrets, OAuth tokens, and registry credentials) sbx secret rm --all + + # Remove a cloud custom secret by its name, or by a host it routes + sbx --cloud secret rm api-example-com + sbx --cloud secret rm --host api.example.com see_also: - sbx secret - Manage stored secrets diff --git a/data/sbx_cli/sbx_secret_set-custom.yaml b/data/sbx_cli/sbx_secret_set-custom.yaml index b5fb5d6628..780c6de261 100644 --- a/data/sbx_cli/sbx_secret_set-custom.yaml +++ b/data/sbx_cli/sbx_secret_set-custom.yaml @@ -16,12 +16,22 @@ description: |- Custom secrets apply globally by default. Use --sandbox to scope one to a specific sandbox. + + With --cloud, --host takes exact DNS names only (no IP addresses or wildcards) + and the proxy sets --header on requests to those hosts instead of substituting + the placeholder. usage: sbx secret set-custom [flags] options: - name: command usage: Use a command's standard output as the secret value - name: env usage: Set this env var in the sandbox to the placeholder value + - name: format + usage: | + How the value fills the header, with one %s; default "Bearer %s" when --header is omitted (with --cloud) + - name: header + usage: | + HTTP header the proxy sets to the secret on requests to --host; default Authorization (with --cloud) - name: help shorthand: h default_value: "false" @@ -29,7 +39,10 @@ options: - name: host default_value: '[]' usage: | - Host, IP, or wildcard pattern (e.g. *.example.com); repeatable + Host, IP, or wildcard pattern (e.g. *.example.com); repeatable; with --cloud, exact DNS names only + - name: name + usage: | + Secret name; default derived from the first --host (with --cloud) - name: no-verify default_value: "false" usage: Skip checking the --ref or --command source when storing it @@ -58,10 +71,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_secret_set.yaml b/data/sbx_cli/sbx_secret_set.yaml index 8f0129ecd4..f5dd8c3097 100644 --- a/data/sbx_cli/sbx_secret_set.yaml +++ b/data/sbx_cli/sbx_secret_set.yaml @@ -88,10 +88,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_settings.yaml b/data/sbx_cli/sbx_settings.yaml new file mode 100644 index 0000000000..8e822038af --- /dev/null +++ b/data/sbx_cli/sbx_settings.yaml @@ -0,0 +1,32 @@ +name: sbx settings +synopsis: Manage Docker Sandboxes settings +description: |- + View and manage settings for Docker Sandboxes. + + Settings can come from defaults, environment variables, or user overrides. + These commands use the local daemon to read evaluated values and manage + overrides, starting it if necessary. + + Most changes take effect within about five seconds. Some require a daemon + restart. +usage: sbx settings COMMAND +options: + - name: help + shorthand: h + default_value: "false" + usage: help for settings +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +see_also: + - sbx - Manage AI coding agent sandboxes. + - sbx settings get - Get the value of a setting + - sbx settings list - List settings + - sbx settings set - Set a setting override + - sbx settings unset - Remove a setting override diff --git a/data/sbx_cli/sbx_settings_get.yaml b/data/sbx_cli/sbx_settings_get.yaml new file mode 100644 index 0000000000..2518082a92 --- /dev/null +++ b/data/sbx_cli/sbx_settings_get.yaml @@ -0,0 +1,33 @@ +name: sbx settings get +synopsis: Get the value of a setting +description: |- + Print the evaluated value of a setting. + + Use --json to print the complete setting record, including its source, type, + default, and description. +usage: sbx settings get [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for get + - name: json + default_value: "false" + usage: Print the complete setting record as JSON +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +example: |4- + # Get a setting value + sbx settings get proxy.daemon + + # Get in JSON format with source info + sbx settings get --json proxy.daemon +see_also: + - sbx settings - Manage Docker Sandboxes settings diff --git a/data/sbx_cli/sbx_settings_list.yaml b/data/sbx_cli/sbx_settings_list.yaml new file mode 100644 index 0000000000..4110db4f75 --- /dev/null +++ b/data/sbx_cli/sbx_settings_list.yaml @@ -0,0 +1,39 @@ +name: sbx settings list +synopsis: List settings +description: |- + List known settings with their evaluated value, type, source, and description. + + The SOURCE column shows where the value came from (default, envvar, or + override). RESTART identifies settings that require 'sbx daemon restart' for + existing daemon-side consumers. Long values and descriptions are truncated to + keep the table readable; use --no-trunc or --json for complete output. Use + 'sbx settings get ' to print one value in full. +usage: sbx settings list [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for list + - name: json + default_value: "false" + usage: Print complete setting records as JSON + - name: no-trunc + default_value: "false" + usage: Show full values and descriptions, one setting per block +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +example: |4- + # List settings as a table + sbx settings list + + # List settings as JSON + sbx settings list --json +see_also: + - sbx settings - Manage Docker Sandboxes settings diff --git a/data/sbx_cli/sbx_settings_set.yaml b/data/sbx_cli/sbx_settings_set.yaml new file mode 100644 index 0000000000..acf619f7ba --- /dev/null +++ b/data/sbx_cli/sbx_settings_set.yaml @@ -0,0 +1,39 @@ +name: sbx settings set +synopsis: Set a setting override +description: |- + Set a user override for a setting. + + The value is parsed according to the setting's type: + bool "true" or "false" + int integer value + float floating-point value + string plain text + json raw JSON + + Environment variables take precedence over user overrides. + + Most changes take effect within about five seconds. If a daemon restart is + required, this command tells you to run 'sbx daemon restart'. +usage: sbx settings set [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for set +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +example: |4- + # Route sandbox, daemon, and CLI egress through an upstream proxy + sbx settings set proxy http://proxy.example.com:3128 + + # Pull template and kit images through a registry mirror + sbx settings set platform.images.registryMirror artifactory.corp/docker-remote +see_also: + - sbx settings - Manage Docker Sandboxes settings diff --git a/data/sbx_cli/sbx_settings_unset.yaml b/data/sbx_cli/sbx_settings_unset.yaml new file mode 100644 index 0000000000..a26570a7b8 --- /dev/null +++ b/data/sbx_cli/sbx_settings_unset.yaml @@ -0,0 +1,26 @@ +name: sbx settings unset +synopsis: Remove a setting override +description: |- + Remove the user override for a setting. + + The setting then evaluates from its environment variable or default value. +usage: sbx settings unset [flags] +options: + - name: help + shorthand: h + default_value: "false" + usage: help for unset +inherited_options: + - name: cloud + default_value: "false" + usage: | + Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) + - name: debug + shorthand: D + default_value: "false" + usage: Enable debug logging +example: |4- + # Remove the override for a setting + sbx settings unset proxy.daemon +see_also: + - sbx settings - Manage Docker Sandboxes settings diff --git a/data/sbx_cli/sbx_setup.yaml b/data/sbx_cli/sbx_setup.yaml index e335fa4c86..efa1ea4f62 100644 --- a/data/sbx_cli/sbx_setup.yaml +++ b/data/sbx_cli/sbx_setup.yaml @@ -21,10 +21,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_setup_ssh.yaml b/data/sbx_cli/sbx_setup_ssh.yaml index ab84b4cf18..7d93c18acc 100644 --- a/data/sbx_cli/sbx_setup_ssh.yaml +++ b/data/sbx_cli/sbx_setup_ssh.yaml @@ -23,10 +23,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_setup_ssh_remove.yaml b/data/sbx_cli/sbx_setup_ssh_remove.yaml index b16afd6153..be61ae48ad 100644 --- a/data/sbx_cli/sbx_setup_ssh_remove.yaml +++ b/data/sbx_cli/sbx_setup_ssh_remove.yaml @@ -12,10 +12,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_skills.yaml b/data/sbx_cli/sbx_skills.yaml index 08b6fb8fac..a42cc95600 100644 --- a/data/sbx_cli/sbx_skills.yaml +++ b/data/sbx_cli/sbx_skills.yaml @@ -18,10 +18,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_skills_add.yaml b/data/sbx_cli/sbx_skills_add.yaml index d0b81073a9..1004ad82c6 100644 --- a/data/sbx_cli/sbx_skills_add.yaml +++ b/data/sbx_cli/sbx_skills_add.yaml @@ -32,10 +32,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_skills_import.yaml b/data/sbx_cli/sbx_skills_import.yaml index 0cb75e370e..de50a44a03 100644 --- a/data/sbx_cli/sbx_skills_import.yaml +++ b/data/sbx_cli/sbx_skills_import.yaml @@ -44,10 +44,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_skills_ls.yaml b/data/sbx_cli/sbx_skills_ls.yaml index 36ee2b0132..b795186e06 100644 --- a/data/sbx_cli/sbx_skills_ls.yaml +++ b/data/sbx_cli/sbx_skills_ls.yaml @@ -11,15 +11,15 @@ options: - name: json default_value: "false" usage: Output in JSON format + - name: quiet + shorthand: q + default_value: "false" + usage: Only display skill names inherited_options: - name: cloud default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_skills_rm.yaml b/data/sbx_cli/sbx_skills_rm.yaml index 955fae1afd..3cc130aca7 100644 --- a/data/sbx_cli/sbx_skills_rm.yaml +++ b/data/sbx_cli/sbx_skills_rm.yaml @@ -21,10 +21,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_skills_update.yaml b/data/sbx_cli/sbx_skills_update.yaml index f69bd6c8b7..2e0010175f 100644 --- a/data/sbx_cli/sbx_skills_update.yaml +++ b/data/sbx_cli/sbx_skills_update.yaml @@ -18,10 +18,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_stop.yaml b/data/sbx_cli/sbx_stop.yaml index b5393b6f37..13fc0f7e72 100644 --- a/data/sbx_cli/sbx_stop.yaml +++ b/data/sbx_cli/sbx_stop.yaml @@ -7,10 +7,12 @@ description: |- Stopped sandboxes retain their state and can be restarted with "sbx run". With --cloud, stop suspends each sandbox in place: its full state (memory + - disk) is preserved, the host is released, and the sandbox keeps its ID. - Restart it — same ID — by running its agent again ("sbx --cloud run ") - and picking the stopped sandbox from the prompt. A detached run (--detached) - creates a new sandbox instead of restarting a stopped one. + disk) is preserved, the host is released, and the sandbox keeps its ID. Stop + returns once the request is accepted. Watch the sandbox reach the stopped + state with "sbx --cloud ls". + Restart it — same ID — with "sbx --cloud attach SANDBOX", with + "sbx --cloud run AGENT --name NAME" (also non-interactively with --detached), + or by running its agent again and picking it from the prompt. Stop does not create a template and does not delete the sandbox. To capture a durable, shareable template from a running sandbox instead, use @@ -27,10 +29,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_template.yaml b/data/sbx_cli/sbx_template.yaml index aad8aa2fb0..c12f169447 100644 --- a/data/sbx_cli/sbx_template.yaml +++ b/data/sbx_cli/sbx_template.yaml @@ -4,10 +4,15 @@ description: |- Manage sandbox templates. Templates are saved snapshots of sandboxes that can be reused to create new - sandboxes with: sbx run -t TAG AGENT [WORKSPACE] + sandboxes with: sbx run --pull never -t TAG AGENT [WORKSPACE] - Cloud mode (--cloud) snapshots and loads typically produce multi-GB artifacts - and take several minutes. See https://docs.docker.com/ai/sandboxes/ for details. + With --cloud: + Manage cloud sandbox templates. + + Reuse a saved template with: sbx --cloud run --template TEMPLATE + + Cloud snapshots and loads typically produce multi-GB artifacts and take + several minutes. See https://docs.docker.com/ai/sandboxes/ for details. usage: sbx template COMMAND options: - name: help @@ -19,10 +24,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_template_inspect.yaml b/data/sbx_cli/sbx_template_inspect.yaml index 28d4a3d635..90b0a5dba4 100644 --- a/data/sbx_cli/sbx_template_inspect.yaml +++ b/data/sbx_cli/sbx_template_inspect.yaml @@ -21,19 +21,15 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" usage: Enable debug logging example: |4- - sbx template inspect my-template --cloud - sbx template inspect tmpl_abc123 --cloud + sbx --cloud template inspect my-template + sbx --cloud template inspect tmpl_abc123 # Output in JSON format - sbx template inspect my-template --cloud --json + sbx --cloud template inspect my-template --json see_also: - sbx template - Manage sandbox templates diff --git a/data/sbx_cli/sbx_template_load.yaml b/data/sbx_cli/sbx_template_load.yaml index e6cfd76ede..4cb424c1c1 100644 --- a/data/sbx_cli/sbx_template_load.yaml +++ b/data/sbx_cli/sbx_template_load.yaml @@ -9,12 +9,17 @@ description: |- With --cloud: The tar is uploaded to the cloud template registry as a new template. Takes two arguments (FILE, NAME). NAME must be unique per account. - --cpus and --memory-mib are required (the server enforces power-of-two - CPUs and memory:cpu ratio constraints). --capture-mode controls what - gets captured for the template: "disk" (default) is faster to load and - cold-boots from the filesystem; "all" captures memory + disk + microVM - checkpoint so subsequent runs resume in sub-second time at the cost of - a slower load. + --cpus and --memory-mib are required, and together must name one of the + billable sandbox shapes: + micro (1 vCPU / 2048 MiB) + small (2 vCPU / 4096 MiB) + medium (4 vCPU / 8192 MiB) + large (8 vCPU / 16384 MiB) + xl (16 vCPU / 32768 MiB) + --capture-mode controls what gets captured for the template: "disk" (default) + is faster to load and cold-boots from the filesystem; "all" captures memory + + disk + microVM checkpoint so subsequent runs resume in sub-second time at the + cost of a slower load. Cloud loads upload your full tar to the registry; multi-GB uploads can take several minutes. See https://docs.docker.com/ai/sandboxes/ for the snapshot/load model. @@ -26,7 +31,8 @@ options: What gets captured for this template. "disk" (default) captures only the filesystem — cold-boot from a standard OCI image, faster load. "all" captures memory + disk + microVM checkpoint — sub-second TTI on resume, slower load. Only effective with --cloud. - name: cpus default_value: "0" - usage: Number of CPUs (1, 2, 4, 8, or 16; required with --cloud) + usage: | + vCPUs; with --memory-mib must name a billable shape (required with --cloud) - name: description usage: Optional template description (--cloud only) - name: help @@ -36,16 +42,12 @@ options: - name: memory-mib default_value: "0" usage: | - Memory in MiB (512–32768, must satisfy 2:1/1:1/1:2 ratio with --cpus; required with --cloud) + Memory in MiB; --cpus/--memory-mib must name a billable shape: micro (1 vCPU / 2048 MiB), small (2 vCPU / 4096 MiB), medium (4 vCPU / 8192 MiB), large (8 vCPU / 16384 MiB), xl (16 vCPU / 32768 MiB) (required with --cloud) inherited_options: - name: cloud default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -56,15 +58,15 @@ example: |4- sbx template load C:\Users\me\myimage.tar # Windows # Use the loaded image as a template - sbx run -t myimage:v1.0 claude + sbx run --pull never -t myimage:v1.0 claude # Cloud: upload a tar as a cloud-managed template (disk capture, faster load) - sbx template load /tmp/myimage.tar my-template --cloud --cpus 2 --memory-mib 2048 + sbx --cloud template load /tmp/myimage.tar my-template --cpus 2 --memory-mib 4096 # Cloud: capture memory + disk + microVM checkpoint for sub-second resume - sbx template load /tmp/myimage.tar my-template --cloud --cpus 2 --memory-mib 2048 --capture-mode all + sbx --cloud template load /tmp/myimage.tar my-template --cpus 2 --memory-mib 4096 --capture-mode all # Cloud: with a description - sbx template load /tmp/myimage.tar my-template --cloud --cpus 2 --memory-mib 2048 --description "Nightly baseline" + sbx --cloud template load /tmp/myimage.tar my-template --cpus 2 --memory-mib 4096 --description "Nightly baseline" see_also: - sbx template - Manage sandbox templates diff --git a/data/sbx_cli/sbx_template_ls.yaml b/data/sbx_cli/sbx_template_ls.yaml index 478da59a08..61c1374f33 100644 --- a/data/sbx_cli/sbx_template_ls.yaml +++ b/data/sbx_cli/sbx_template_ls.yaml @@ -11,15 +11,15 @@ options: - name: json default_value: "false" usage: Output in JSON format + - name: quiet + shorthand: q + default_value: "false" + usage: Only display template names inherited_options: - name: cloud default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_template_rm.yaml b/data/sbx_cli/sbx_template_rm.yaml index a340798f22..c17e0cdce0 100644 --- a/data/sbx_cli/sbx_template_rm.yaml +++ b/data/sbx_cli/sbx_template_rm.yaml @@ -9,9 +9,13 @@ description: |- With --cloud: The template can be identified by its tmpl_* ID or by its human name - (resolved via the server-side ?name= filter). Use "sbx template ls --cloud". + (resolved via the server-side ?name= filter). Use "sbx --cloud template ls". usage: sbx template rm TAG|ID|NAME [flags] options: + - name: force + shorthand: f + default_value: "false" + usage: Skip confirmation prompts - name: help shorthand: h default_value: "false" @@ -21,10 +25,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -37,9 +37,9 @@ example: |4- sbx template rm abc123 # Cloud: remove by name - sbx template rm my-template --cloud + sbx --cloud template rm my-template # Cloud: remove by tmpl_* id - sbx template rm tmpl_abc123 --cloud + sbx --cloud template rm tmpl_abc123 see_also: - sbx template - Manage sandbox templates diff --git a/data/sbx_cli/sbx_template_save.yaml b/data/sbx_cli/sbx_template_save.yaml index 025e4866d1..7dd11ab43b 100644 --- a/data/sbx_cli/sbx_template_save.yaml +++ b/data/sbx_cli/sbx_template_save.yaml @@ -4,7 +4,10 @@ description: |- Save a snapshot of the sandbox as a template. The saved image is stored in the sandbox runtime's image store and can be - used as a template for new sandboxes with: sbx run -t TAG AGENT [WORKSPACE] + used as a template for new sandboxes with: + sbx run --pull never -t TAG AGENT [WORKSPACE] + + Use --pull never to use the saved image without trying to pull it from a registry. Use --output to also export the image to a tar file that can be shared and loaded on another host with: sbx template load FILE @@ -42,10 +45,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" @@ -58,12 +57,12 @@ example: |4- sbx template save my-sandbox myimage:v1.0 --output /tmp/myimage.tar # Cloud: snapshot a running cloud sandbox into a cloud-managed template - sbx template save sbx_abc123 my-snap --cloud + sbx --cloud template save sbx_abc123 my-snap # Cloud: attach a description to the saved template - sbx template save sbx_abc123 my-snap --cloud --description "nightly build" + sbx --cloud template save sbx_abc123 my-snap --description "nightly build" # Cloud: capture memory + disk + microVM checkpoint for sub-second resume - sbx template save sbx_abc123 my-snap --cloud --capture-mode all + sbx --cloud template save sbx_abc123 my-snap --capture-mode all see_also: - sbx template - Manage sandbox templates diff --git a/data/sbx_cli/sbx_ttl.yaml b/data/sbx_cli/sbx_ttl.yaml index 7fa02d02ea..b146884a75 100644 --- a/data/sbx_cli/sbx_ttl.yaml +++ b/data/sbx_cli/sbx_ttl.yaml @@ -9,7 +9,8 @@ description: |- With two arguments — a duration prefixed with '+' followed by a sandbox ID or name — extends the TTL by that amount, subject to the server-enforced ceiling. The server cannot shorten an expiration, so DURATION must be - positive. + positive. Units are Go's duration units (h, m, s, ms, us, ns), in either + case (+2h, +2H, +1h30m). SANDBOX may be given by ID (sbx_*) or name, as shown by "sbx --cloud ls". @@ -28,10 +29,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_tui.yaml b/data/sbx_cli/sbx_tui.yaml index 3bfecf8384..3ced609713 100644 --- a/data/sbx_cli/sbx_tui.yaml +++ b/data/sbx_cli/sbx_tui.yaml @@ -11,10 +11,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_version.yaml b/data/sbx_cli/sbx_version.yaml index bcaa9d9a8d..0f732b94de 100644 --- a/data/sbx_cli/sbx_version.yaml +++ b/data/sbx_cli/sbx_version.yaml @@ -15,10 +15,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_volume.yaml b/data/sbx_cli/sbx_volume.yaml index 08009696b3..de0a4ab7b3 100644 --- a/data/sbx_cli/sbx_volume.yaml +++ b/data/sbx_cli/sbx_volume.yaml @@ -20,10 +20,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_volume_create.yaml b/data/sbx_cli/sbx_volume_create.yaml index 734aacba3d..d80eafbda8 100644 --- a/data/sbx_cli/sbx_volume_create.yaml +++ b/data/sbx_cli/sbx_volume_create.yaml @@ -19,10 +19,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_volume_inspect.yaml b/data/sbx_cli/sbx_volume_inspect.yaml index da8a85510d..c2b0f46ae3 100644 --- a/data/sbx_cli/sbx_volume_inspect.yaml +++ b/data/sbx_cli/sbx_volume_inspect.yaml @@ -11,10 +11,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_volume_ls.yaml b/data/sbx_cli/sbx_volume_ls.yaml index 900fadf4c6..6493b0bb04 100644 --- a/data/sbx_cli/sbx_volume_ls.yaml +++ b/data/sbx_cli/sbx_volume_ls.yaml @@ -9,15 +9,15 @@ options: - name: json default_value: "false" usage: Output in JSON format + - name: quiet + shorthand: q + default_value: "false" + usage: Only display volume names inherited_options: - name: cloud default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false" diff --git a/data/sbx_cli/sbx_volume_rm.yaml b/data/sbx_cli/sbx_volume_rm.yaml index d6636c7a72..4f2d63f7f6 100644 --- a/data/sbx_cli/sbx_volume_rm.yaml +++ b/data/sbx_cli/sbx_volume_rm.yaml @@ -20,10 +20,6 @@ inherited_options: default_value: "false" usage: | Dispatch to Docker Cloud Sandboxes API instead of local sandboxd (supported by a growing set of verbs — run 'sbx --cloud --help' for the current list) - - name: cloud-api-url - default_value: https://api.sandboxes-cloud.docker.com - usage: | - Cloud Sandboxes API base URL; only used with --cloud. Defaults to prod (https://api.sandboxes-cloud.docker.com). Set DOCKER_CLOUD_API_URL or pass this flag to override; a legacy value ending in /v1 is accepted. - name: debug shorthand: D default_value: "false"