docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-10-23 18:09:02 +03:00
Code Activity

docs: clarify custom secret injection is limited to headers (#26377)

Browse Source 
## Summary

Custom secret injection is limited to HTTP request headers, but the
credentials page recommended it for secrets in request bodies and
described replacement anywhere in a request. Remove that use case and
clarify the header-only restriction.

@netlify /ai/sandboxes/configuration/credentials/

Generated by Codex
This commit is contained in:
David Karlsson
2026-10-20 09:20:48 +02:00
committed by GitHub
parent 84602ad93d
commit 95b8ec69e3
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
content/manuals/ai/sandboxes/configuration/credentials.md
View File

@@ -39,7 +39,7 @@ value for the same service, the stored secret takes precedence.
| Form | What it is | Use it when |
| --------------------------------------------------------------------------- | ------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------- |
| [Stored secrets](#stored-secrets) (`sbx secret set`) | A value or dynamic source in your OS keychain, keyed by service | The default for any built-in or kit-declared service |
| [Custom secrets](#custom-secrets) (`sbx secret set-custom`) | A value keyed to a domain and environment variable | The service model doesn't fit — the agent validates the variable's format, or the secret rides in a request body |
| [Custom secrets](#custom-secrets) (`sbx secret set-custom`) | A value keyed to a domain and environment variable | The service model doesn't fit, or the agent validates the variable's format |
| OAuth | A host-side sign-in flow; the token never enters the sandbox | The agent supports it, such as Claude Code, Codex, Cursor, or Droid |
| [Registry credentials](#registry-credentials) (`sbx secret set --registry`) | Authentication for pulling images and kits | Pulling templates or kits from a private registry |
@@ -417,8 +417,7 @@ network policy. For details, see
> change without notice.
For credentials that don't fit the service-identifier model — for example,
when an agent validates the environment variable format at boot, or when the
credential lands in a request body rather than a header — use
when an agent validates the environment variable format at boot — use
`sbx secret set-custom`. The secret is keyed on one or more target domains, an
environment variable name, and an optional placeholder string, instead of a
service identifier.
@@ -447,8 +446,9 @@ $ sbx secret set-custom \
Inside the sandbox, `API_KEY` is set to a generated placeholder (for example,
`sbx-cs-<rand>`). When a sandboxed process sends a request to any of the
configured hosts and the placeholder appears anywhere in the request, the
proxy replaces it with the real value. The agent never sees the real secret.
configured hosts and the placeholder appears in an HTTP request header, the
proxy replaces it with the real value. Replacement applies only to HTTP request
headers, not request bodies. The agent never sees the real secret.
### Target multiple hosts