diff --git a/content/manuals/ai/sandboxes/release-notes.md b/content/manuals/ai/sandboxes/release-notes.md index cabe50526e..814afebd3f 100644 --- a/content/manuals/ai/sandboxes/release-notes.md +++ b/content/manuals/ai/sandboxes/release-notes.md @@ -16,6 +16,105 @@ the full release history, including pre-releases and downloads, see the +## 0.38.0 + +{{< release-date date="2026-08-06" >}} + +[GitHub release](https://github.com/docker/sbx-releases/releases/tag/v0.38.0) + +### Highlights + +**Kit spec v2.** A new schema is available for authoring kits, with a clearer structure for setup, permissions, agent instructions, networking, and credentials. Use `schemaVersion: "2"` for new kits; existing v1 kits continue to load through the legacy path. See the [kit spec reference](https://docs.docker.com/ai/sandboxes/customize/kit-reference/#schema-versions) for migration details. + +**MCP management is now a first-class feature.** Register remote or local MCP servers once with `sbx mcp`, then reuse them across supported agents and sandboxes through a built-in MCP gateway. OAuth credentials stay on the host, and organizations can govern server registration and tool calls with Cedar policies. See the [MCP gateway documentation](https://docs.docker.com/ai/sandboxes/mcp-gateway/). + +### What's new + +#### CLI + +- `sbx create` and `sbx run` show detailed structured progress during startup, including environment files loaded, resources provisioned, and each kit command's outcome; kit-install progress streams live during `sbx create --kit`. +- Added `sbx daemon restart` to stop and restart the sandboxd daemon in the background. +- `sbx inspect` now displays custom secrets configured for a sandbox. +- `DOCKER_SANDBOXES_CLONED_WORKSPACE_SIZE` configures the size of the cloned workspace volume. +- `sbx setup ssh` warns when `ssh` is missing from PATH, and on Windows when `sh` (required by Claude Desktop's SSH ProxyCommand) is missing. +- Port publishing failures now identify the affected host port and explain when the OS requires extra daemon privileges. + +#### MCP + +- The `sbx mcp` subcommand is now available for managing MCP servers. +- Includes dynamic MCP tools (`mcp-find`, `mcp-add`, `mcp-config-set`) for attaching registered servers to sandboxes. +- Govern MCP servers and tools for your organization using Cedar policies. + +#### Networking & policy + +- `--deny-network HOST` on `sbx run` and `sbx create` records per-sandbox network deny rules at creation time, with layer-aware egress messages. +- `sbx policy allow network` reports a clear "managed by your organization" error when org governance overrides the local allow, and failed rule removals now explain what went wrong using a single rule identifier. +- Signing in refreshes organization policies in the running daemon immediately instead of waiting for the next polling interval. +- IP-literal destinations denied by a CIDR rule fail fast with a policy message instead of timing out. +- Blocked HTTPS proxy connections appear in `sbx policy log` even when the client aborts the TLS handshake. + +#### Secrets & credentials + +- Service and custom secrets are global by default, with `--sandbox` for sandbox scope; legacy positional and `--global` forms are deprecated with warnings. +- Sandbox-scoped GitHub credentials added after creation now work without recreating the sandbox. +- Pressing Ctrl+C while entering a secret cancels the command without saving it. + +#### Agents + +- Docker Agent and OpenCode sandboxes can authenticate GitHub Copilot requests with proxy-managed GitHub credentials. +- Codex sandboxes created from the TUI prefer stored OpenAI OAuth credentials over API keys; kit environment variables now reach cloud agents, and git no longer hangs Codex startup prompting for credentials. +- Shared agent skills: directory symlinks under the skills folder are resolved and their contents imported. + +#### Kits & templates + +- Kit specs use the new v2 grammar. +- Kits using `extends` correctly inherit and override the base image or build source of their parent. +- Kit install commands can consume static files from `files/home`, including binary files. + +#### Packaging + +- Homebrew installs from a stapled `.dmg` artifact rather than a `.tar.gz` archive, improving Gatekeeper compatibility on macOS. +- Windows: the running sandboxd daemon is stopped during a WinGet/MSI upgrade so client and server end up on the same version. + +#### Security + +- Claude Desktop SSH sessions no longer expose Desktop OAuth access tokens inside sandboxes. +- Fixed a destination-escape flaw in `sbx cp` copy-out (CVE-2026-17106). +- The daemon's loopback egress proxy only serves the daemon's own traffic, preventing other local users on a multi-user host from reaching the configured upstream proxy through it. + +#### Bug fixes + +- Fixed a hang where sandboxd stopped answering all endpoints and could not be stopped without SIGKILL after a crash; fatal daemon tracebacks are now included in `sbx diagnose --upload` bundles. +- Fixed intermittent sandboxd startup failures when a running daemon was slow to answer its health check. +- Fixed `sbx daemon stop` hanging when an idle SSH session (for example, Claude Desktop) was connected to a sandbox. +- sandboxd automatically repairs a corrupted local image cache by re-pulling the image, and otherwise reports a clear "run `sbx daemon reset`" error. +- Fixed recreate failures ("base image not found") after daemon restarts when swapping a sandbox's container via `sbx kit add`; recreates self-heal by recomposing from the sandbox's template. +- Fixed reverse DNS (PTR) lookups from sandboxes returning NXDOMAIN for container-resolved addresses. +- Fixed a goroutine and network-endpoint leak from hijacked HTTP CONNECT tunnels that could eventually stall sandbox creation after many delete/recreate cycles. +- Fixed an intermittent 500 error when deleting a sandbox while its network endpoints were being torn down. +- The daemon restores saved sandboxes' network proxies in parallel on restart, speeding up startup with several sandboxes and fixing a potential crash during first-run policy application. +- Fixed host `.git/config` corruption when creating a sandbox for repositories using `includeIf` directives in `~/.gitconfig`; the sandbox now writes git identity only to the container's gitconfig. +- `sbx skills` shows a single usage form and clearer help for importing shared agent skills. +- sbx no longer reports that a stored credential was not injected when the daemon injects it. + +### Experimental features + +#### Enterprise networking + +Settings-driven upstream-proxy configuration with separate sandbox and daemon scopes, integrated NTLM/Kerberos proxy authentication on Windows. + +- Configure separate proxy settings for sandbox and daemon traffic using `proxy`, `proxy.sandbox`, `proxy.daemon`, and the matching `no_proxy` settings. These default to the host operating system's proxy settings. The daemon's own traffic, including image pulls and telemetry, also uses the configured proxy. +- On Windows, sbx can authenticate to upstream proxies that require integrated NTLM or Kerberos/Negotiate authentication. Enable this behavior with the `proxy.integratedAuth` setting. +- If a TLS-inspecting proxy issues certificates with negative serial numbers, enable compatibility with `sbx settings set tls.allowNegativeSerial true`, then restart the daemon. + +#### GPU passthrough + +Run a sandbox with NVIDIA VFIO GPU passthrough on Linux using `sbx run --gpu`. Enable this feature with `sbx settings set feature.sandbox-gpu true`. + +#### Local models + +Run Claude Code against a local GGUF model with `sbx run --model claude`. To use a model from an existing Ollama installation, prefix the model name with `ollama/`. See [Claude Code > Use a local model](https://docs.docker.com/ai/sandboxes/agents/claude-code/#use-a-local-model). + ## 0.37.1 {{< release-date date="2026-07-29" >}} @@ -150,51 +249,6 @@ There are no Linux/ARM64 builds for v0.35.x due to stability issues that were en - Block installation on Windows versions older than Windows 11 (the only currently supported version). -## 0.34.0 - -{{< release-date date="2026-06-26" >}} - -[GitHub release](https://github.com/docker/sbx-releases/releases/tag/v0.34.0) - -### Highlights - -Kit installs are now restricted to an allowlist of sources, defaulting to Docker Hub only — a **breaking change** if you install kits from a Git URL or another registry. - -This release also renames `sbx policy set-default` to `sbx policy init`, restores published ports when a sandbox restarts, fixes a number of bugs, and adds two experimental previews: a native SSH endpoint and an `sbx setup` command for smoother first-time onboarding. - -### What's New - -#### SSH - -- Add an experimental native SSH endpoint in sandboxd: connect with `ssh @127.0.0.1 -p 2222` (publickey auth, connect-to-create, interactive shell and exec; no SFTP yet). Enable with `sbx settings set feature.ssh true`. - -#### Setup & Onboarding - -- Add an experimental `sbx setup` command that imports agent credentials from environment variables. - -#### Agents - -- Cursor sandboxes no longer show the workspace trust prompt on launch. - -#### Kits - -- Add OCI v2 kit artifact streaming that decompresses the layer once to a cache directory and uses seek-based random access, so file content is not held in memory between reads. -- Restrict kit installs to an allowlist of sources, defaulting to Docker Hub (`docker.io/`) only. - - **Breaking:** installing a kit from another registry or a Git URL fails until you add its prefix with `sbx settings set kit.allowedSources`. See [Docs: Restrict kit sources](https://docs.docker.com/ai/sandboxes/customize/kits#restrict-kit-sources) for details. - -#### CLI & Behavior Changes - -- Rename `sbx policy set-default` to `sbx policy init`; the old name keeps working as a hidden, deprecated alias. -- Published sandbox ports are restored on restart, and the CLI/TUI can recover explicit host-port conflicts by choosing a new host port. - -#### Bug Fixes - -- Fix a daemon hang where a slow or stuck sandbox creation/deletion blocked `sbx ls`, the TUI, and new sessions until the daemon was restarted. -- Fix a kit mixin regression where adding `network.serviceDomains` for a service already provided by the base agent failed with a "credential … defined in both" error. -- Reject `+` in sandbox names with a clear validation error instead of panicking. -- Fix the interactive host-port conflict recovery prompt not appearing on Windows when restarting a sandbox whose published port is already in use. - ## Earlier releases