docker/docs
1
0
Fork 0
mirror of https://github.com/docker/docs.git synced 2026-10-28 07:15:09 +03:00
Code Activity

sbx: update release notes (#25411)

Browse Source 
<!--Delete sections as needed -->

## Description

Refreshed sbx release notes based on upstream.

## Related issues or tickets

https://docker.slack.com/archives/C09E0594URW/p1782139817528369

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [ ] Technical review
- [ ] Editorial review

---------

Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
This commit is contained in:
Craig Osterhout
2026-06-22 08:36:40 -07:00
committed by GitHub
parent f1c44df2cd
commit eb4f2ed75d
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
content/manuals/ai/sandboxes/release-notes.md
View File

@@ -43,8 +43,8 @@ This release also improves network isolation and policy enforcement. Sandbox DNS
#### Networking & Proxy
- Sandbox DNS lookups are now gated on the network policy: a sandboxed process can no longer resolve domains that policy denies, closing a DNS-based data-exfiltration channel. Loopback names (e.g. `localhost`) are exempt to avoid breaking local OAuth callback flows.
- Outgoing ICMP from sandboxes is now blocked across daemon restarts.
- Sandbox DNS lookups are now gated on the network policy: a sandboxed process can no longer resolve domains that policy denies, closing a DNS-based data-exfiltration channel. Loopback names (e.g. `localhost`) are exempt to avoid breaking local OAuth callback flows. [CVE-2026-12039](https://www.cve.org/CVERecord?id=CVE-2026-12039)
- Outgoing ICMP from sandboxes is now blocked across daemon restarts. [CVE-2026-12539](https://www.cve.org/CVERecord?id=CVE-2026-12539)
- CIDR subnet allow rules (e.g. `sbx policy allow network 10.10.14.0/24`) now correctly permit traffic to IP addresses within the subnet.
- The MITM proxy now publishes a CRL and embeds a CRL distribution point in generated certificates, fixing clients that require certificate revocation checking (e.g. .NET `CheckCertificateRevocationList=true`).
- Removed the bracketed `[::1]` entry from the sandbox `NO_PROXY` default, fixing credential injection for HTTP clients that mis-parsed it.
@@ -56,7 +56,7 @@ This release also improves network isolation and policy enforcement. Sandbox DNS
#### Agents
- Fixed Cursor repeatedly prompting for login; Cursor OAuth credentials now also appear in `sbx secret ls`.
- Cursor OAuth is now supported
#### Platform & Performance