mirror of
https://github.com/docker/docs.git
synced 2026-10-25 06:09:46 +03:00
chore: sync sbx v0.38.0 release notes
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
This commit is contained in:
David Karlsson
@@ -16,6 +16,105 @@ the full release history, including pre-releases and downloads, see the
|
||||
|
||||
<!-- BEGIN GENERATED RELEASES -->
|
||||
|
||||
## 0.38.0
|
||||
|
||||
{{< release-date date="2026-08-06" >}}
|
||||
|
||||
[GitHub release](https://github.com/docker/sbx-releases/releases/tag/v0.38.0)
|
||||
|
||||
### Highlights
|
||||
|
||||
**Kit spec v2.** A new schema is available for authoring kits, with a clearer structure for setup, permissions, agent instructions, networking, and credentials. Use `schemaVersion: "2"` for new kits; existing v1 kits continue to load through the legacy path. See the [kit spec reference](https://docs.docker.com/ai/sandboxes/customize/kit-reference/#schema-versions) for migration details.
|
||||
|
||||
**MCP management is now a first-class feature.** Register remote or local MCP servers once with `sbx mcp`, then reuse them across supported agents and sandboxes through a built-in MCP gateway. OAuth credentials stay on the host, and organizations can govern server registration and tool calls with Cedar policies. See the [MCP gateway documentation](https://docs.docker.com/ai/sandboxes/mcp-gateway/).
|
||||
|
||||
### What's new
|
||||
|
||||
#### CLI
|
||||
|
||||
- `sbx create` and `sbx run` show detailed structured progress during startup, including environment files loaded, resources provisioned, and each kit command's outcome; kit-install progress streams live during `sbx create --kit`.
|
||||
- Added `sbx daemon restart` to stop and restart the sandboxd daemon in the background.
|
||||
- `sbx inspect` now displays custom secrets configured for a sandbox.
|
||||
- `DOCKER_SANDBOXES_CLONED_WORKSPACE_SIZE` configures the size of the cloned workspace volume.
|
||||
- `sbx setup ssh` warns when `ssh` is missing from PATH, and on Windows when `sh` (required by Claude Desktop's SSH ProxyCommand) is missing.
|
||||
- Port publishing failures now identify the affected host port and explain when the OS requires extra daemon privileges.
|
||||
|
||||
#### MCP
|
||||
|
||||
- The `sbx mcp` subcommand is now available for managing MCP servers.
|
||||
- Includes dynamic MCP tools (`mcp-find`, `mcp-add`, `mcp-config-set`) for attaching registered servers to sandboxes.
|
||||
- Govern MCP servers and tools for your organization using Cedar policies.
|
||||
|
||||
#### Networking & policy
|
||||
|
||||
- `--deny-network HOST` on `sbx run` and `sbx create` records per-sandbox network deny rules at creation time, with layer-aware egress messages.
|
||||
- `sbx policy allow network` reports a clear "managed by your organization" error when org governance overrides the local allow, and failed rule removals now explain what went wrong using a single rule identifier.
|
||||
- Signing in refreshes organization policies in the running daemon immediately instead of waiting for the next polling interval.
|
||||
- IP-literal destinations denied by a CIDR rule fail fast with a policy message instead of timing out.
|
||||
- Blocked HTTPS proxy connections appear in `sbx policy log` even when the client aborts the TLS handshake.
|
||||
|
||||
#### Secrets & credentials
|
||||
|
||||
- Service and custom secrets are global by default, with `--sandbox` for sandbox scope; legacy positional and `--global` forms are deprecated with warnings.
|
||||
- Sandbox-scoped GitHub credentials added after creation now work without recreating the sandbox.
|
||||
- Pressing Ctrl+C while entering a secret cancels the command without saving it.
|
||||
|
||||
#### Agents
|
||||
|
||||
- Docker Agent and OpenCode sandboxes can authenticate GitHub Copilot requests with proxy-managed GitHub credentials.
|
||||
- Codex sandboxes created from the TUI prefer stored OpenAI OAuth credentials over API keys; kit environment variables now reach cloud agents, and git no longer hangs Codex startup prompting for credentials.
|
||||
- Shared agent skills: directory symlinks under the skills folder are resolved and their contents imported.
|
||||
|
||||
#### Kits & templates
|
||||
|
||||
- Kit specs use the new v2 grammar.
|
||||
- Kits using `extends` correctly inherit and override the base image or build source of their parent.
|
||||
- Kit install commands can consume static files from `files/home`, including binary files.
|
||||
|
||||
#### Packaging
|
||||
|
||||
- Homebrew installs from a stapled `.dmg` artifact rather than a `.tar.gz` archive, improving Gatekeeper compatibility on macOS.
|
||||
- Windows: the running sandboxd daemon is stopped during a WinGet/MSI upgrade so client and server end up on the same version.
|
||||
|
||||
#### Security
|
||||
|
||||
- Claude Desktop SSH sessions no longer expose Desktop OAuth access tokens inside sandboxes.
|
||||
- Fixed a destination-escape flaw in `sbx cp` copy-out (CVE-2026-17106).
|
||||
- The daemon's loopback egress proxy only serves the daemon's own traffic, preventing other local users on a multi-user host from reaching the configured upstream proxy through it.
|
||||
|
||||
#### Bug fixes
|
||||
|
||||
- Fixed a hang where sandboxd stopped answering all endpoints and could not be stopped without SIGKILL after a crash; fatal daemon tracebacks are now included in `sbx diagnose --upload` bundles.
|
||||
- Fixed intermittent sandboxd startup failures when a running daemon was slow to answer its health check.
|
||||
- Fixed `sbx daemon stop` hanging when an idle SSH session (for example, Claude Desktop) was connected to a sandbox.
|
||||
- sandboxd automatically repairs a corrupted local image cache by re-pulling the image, and otherwise reports a clear "run `sbx daemon reset`" error.
|
||||
- Fixed recreate failures ("base image not found") after daemon restarts when swapping a sandbox's container via `sbx kit add`; recreates self-heal by recomposing from the sandbox's template.
|
||||
- Fixed reverse DNS (PTR) lookups from sandboxes returning NXDOMAIN for container-resolved addresses.
|
||||
- Fixed a goroutine and network-endpoint leak from hijacked HTTP CONNECT tunnels that could eventually stall sandbox creation after many delete/recreate cycles.
|
||||
- Fixed an intermittent 500 error when deleting a sandbox while its network endpoints were being torn down.
|
||||
- The daemon restores saved sandboxes' network proxies in parallel on restart, speeding up startup with several sandboxes and fixing a potential crash during first-run policy application.
|
||||
- Fixed host `.git/config` corruption when creating a sandbox for repositories using `includeIf` directives in `~/.gitconfig`; the sandbox now writes git identity only to the container's gitconfig.
|
||||
- `sbx skills` shows a single usage form and clearer help for importing shared agent skills.
|
||||
- sbx no longer reports that a stored credential was not injected when the daemon injects it.
|
||||
|
||||
### Experimental features
|
||||
|
||||
#### Enterprise networking
|
||||
|
||||
Settings-driven upstream-proxy configuration with separate sandbox and daemon scopes, integrated NTLM/Kerberos proxy authentication on Windows.
|
||||
|
||||
- Configure separate proxy settings for sandbox and daemon traffic using `proxy`, `proxy.sandbox`, `proxy.daemon`, and the matching `no_proxy` settings. These default to the host operating system's proxy settings. The daemon's own traffic, including image pulls and telemetry, also uses the configured proxy.
|
||||
- On Windows, sbx can authenticate to upstream proxies that require integrated NTLM or Kerberos/Negotiate authentication. Enable this behavior with the `proxy.integratedAuth` setting.
|
||||
- If a TLS-inspecting proxy issues certificates with negative serial numbers, enable compatibility with `sbx settings set tls.allowNegativeSerial true`, then restart the daemon.
|
||||
|
||||
#### GPU passthrough
|
||||
|
||||
Run a sandbox with NVIDIA VFIO GPU passthrough on Linux using `sbx run --gpu`. Enable this feature with `sbx settings set feature.sandbox-gpu true`.
|
||||
|
||||
#### Local models
|
||||
|
||||
Run Claude Code against a local GGUF model with `sbx run --model <name> claude`. To use a model from an existing Ollama installation, prefix the model name with `ollama/`. See [Claude Code > Use a local model](https://docs.docker.com/ai/sandboxes/agents/claude-code/#use-a-local-model).
|
||||
|
||||
## 0.37.1
|
||||
|
||||
{{< release-date date="2026-07-29" >}}
|
||||
@@ -150,51 +249,6 @@ There are no Linux/ARM64 builds for v0.35.x due to stability issues that were en
|
||||
|
||||
- Block installation on Windows versions older than Windows 11 (the only currently supported version).
|
||||
|
||||
## 0.34.0
|
||||
|
||||
{{< release-date date="2026-06-26" >}}
|
||||
|
||||
[GitHub release](https://github.com/docker/sbx-releases/releases/tag/v0.34.0)
|
||||
|
||||
### Highlights
|
||||
|
||||
Kit installs are now restricted to an allowlist of sources, defaulting to Docker Hub only — a **breaking change** if you install kits from a Git URL or another registry.
|
||||
|
||||
This release also renames `sbx policy set-default` to `sbx policy init`, restores published ports when a sandbox restarts, fixes a number of bugs, and adds two experimental previews: a native SSH endpoint and an `sbx setup` command for smoother first-time onboarding.
|
||||
|
||||
### What's New
|
||||
|
||||
#### SSH
|
||||
|
||||
- Add an experimental native SSH endpoint in sandboxd: connect with `ssh <sandbox-name>@127.0.0.1 -p 2222` (publickey auth, connect-to-create, interactive shell and exec; no SFTP yet). Enable with `sbx settings set feature.ssh true`.
|
||||
|
||||
#### Setup & Onboarding
|
||||
|
||||
- Add an experimental `sbx setup` command that imports agent credentials from environment variables.
|
||||
|
||||
#### Agents
|
||||
|
||||
- Cursor sandboxes no longer show the workspace trust prompt on launch.
|
||||
|
||||
#### Kits
|
||||
|
||||
- Add OCI v2 kit artifact streaming that decompresses the layer once to a cache directory and uses seek-based random access, so file content is not held in memory between reads.
|
||||
- Restrict kit installs to an allowlist of sources, defaulting to Docker Hub (`docker.io/`) only.
|
||||
|
||||
**Breaking:** installing a kit from another registry or a Git URL fails until you add its prefix with `sbx settings set kit.allowedSources`. See [Docs: Restrict kit sources](https://docs.docker.com/ai/sandboxes/customize/kits#restrict-kit-sources) for details.
|
||||
|
||||
#### CLI & Behavior Changes
|
||||
|
||||
- Rename `sbx policy set-default` to `sbx policy init`; the old name keeps working as a hidden, deprecated alias.
|
||||
- Published sandbox ports are restored on restart, and the CLI/TUI can recover explicit host-port conflicts by choosing a new host port.
|
||||
|
||||
#### Bug Fixes
|
||||
|
||||
- Fix a daemon hang where a slow or stuck sandbox creation/deletion blocked `sbx ls`, the TUI, and new sessions until the daemon was restarted.
|
||||
- Fix a kit mixin regression where adding `network.serviceDomains` for a service already provided by the base agent failed with a "credential … defined in both" error.
|
||||
- Reject `+` in sandbox names with a clear validation error instead of panicking.
|
||||
- Fix the interactive host-port conflict recovery prompt not appearing on Windows when restarting a sandbox whose published port is already in use.
|
||||
|
||||
<!-- END GENERATED RELEASES -->
|
||||
|
||||
## Earlier releases
|
||||
|
||||
Reference in New Issue
Block a user