docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-10-28 07:15:09 +03:00
Code Activity

docs(sandboxes): clarify environment file placement (#25907)

Browse Source 
Clarify that .sbxenv.yaml must stay outside the primary workspace and any additionalWorkspaces mounts, and make the direct-mount warning explicit in the field reference.

Change notes:
- content/manuals/ai/sandboxes/configuration/environment-files.md - clarify that environment files must stay outside every mounted workspace
This commit is contained in:
Niels Kaspers
2026-08-21 09:10:38 +03:00
parent 158b823dc4
commit b47f522560
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
content/manuals/ai/sandboxes/configuration/environment-files.md
View File

@@ -31,6 +31,7 @@ setup steps.
## Start an environment
Keep the environment file outside the directories you mount into the sandbox.
That includes the primary workspace and every `additionalWorkspaces` mount.
For example, place it beside your project:
```text
@@ -73,7 +74,9 @@ named `web-app`, installs Playwright and Chromium, and publishes sandbox port
existing sandbox.
This placement keeps the environment file outside the agent's writable
workspace. See the [`workspace` guidance](#workspace) for details.
workspace. If you later add `additionalWorkspaces`, keep `.sbxenv.yaml`
outside those directories too. See the [`workspace` guidance](#workspace)
for details.
## Commands
@@ -263,7 +266,8 @@ clone mode:
> With [direct mount](../security/isolation.md#direct-mount-default), the agent can
> modify every file in a workspace. If an environment file is inside a mounted
> workspace, the agent can change the file that controls later `sbx env`
> commands. Store environment files outside all direct-mounted workspaces.
> commands. Store environment files outside all direct-mounted workspaces,
> including every `additionalWorkspaces` mount.
> [Clone mode](../security/isolation.md#clone-mode) protects files in the primary
> repository, but additional workspaces remain direct-mounted.