The "Admin Console" sidebar entry no longer exists in Docker Home. Sandbox
governance policies now live under the new "AI Platform" section (Network
access, Filesystem access). Update the create-a-policy navigation to the new
structure. Reference the UI (Docker Home / AI Platform) only where it's an
actual navigation instruction or a UI-vs-API contrast; drop decorative
location mentions elsewhere.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a troubleshooting nudge to restart the sbx daemon before using destructive reset steps when sandbox commands hang or report daemon errors.
Clarify the diagnostics overview by referring to daemon reachability problems instead of an unverified unresponsive-daemon message.
## Summary
The `docker sandbox` Docker Desktop plugin was fully removed in Docker
Desktop 4.80.0. This PR:
- Deletes `content/manuals/ai/sandboxes/docker-desktop.md`
- Deletes all 21 CLI reference YAML files under `data/cli/sandbox/`
- Updates `content/manuals/retired.md` to say the feature was removed
(not just deprecated), with a pointer to `sbx`
- Updates `content/manuals/ai-overview.md` to show `sbx` as the CLI
command instead of `docker sandbox`
Generated by Claude Code
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
The `docker sandbox` Docker Desktop plugin was fully removed in Docker
Desktop 4.80.0. Remove the dedicated docs page, all CLI reference YAML
files, and update the retired products page to reflect removal rather
than deprecation. Update the AI overview table to reference `sbx`.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Summary
The "Policy changes not taking effect" troubleshooting section only
described
network policy propagation. Expanded it to explain that filesystem
policy is
evaluated only at mount time (sandbox creation), so a policy change does
not
affect already-running sandboxes — users must remove and recreate the
sandbox
for a filesystem policy change to take effect. Network policy, by
contrast, is
evaluated on every request and updates within the propagation window.
Generated by Claude Code
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Documents the new `DOCKER_SANDBOXES_ROOT_SIZE` environment variable,
which lets users increase the sandbox root (`/`) filesystem size beyond
the 20 GB default. Adds a new "Sandbox runs out of disk space" section
to the troubleshooting page, clarifying the distinction between this
variable and the existing `DOCKER_SANDBOXES_DOCKER_SIZE` (Docker data
disk only).
Generated by Claude Code
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Updates the credentials documentation for Docker Sandboxes:
- Removes the environment variables section. Exporting API keys in your
host shell is no longer a supported authentication path; use `sbx secret
set` or `sbx secret import` instead.
- Adds `sbx secret import` documentation: imports recognized API key
environment variables from your shell into the keychain in one step,
with flags for non-interactive use (`--all`), overwriting (`--force`),
and dry-run preview.
- Lightens the get-started authentication section to lead with OAuth as
the primary path for Claude Code, pointing to the credentials page for
API key setup.
- Reverts agent pages that previously described a first-run credential
prompt that no longer applies to built-in agents.
## What's not in this PR
The credential bindings / `credentials.yaml` / first-run approval flow
for third-party kit authors lands alongside the schemaVersion 2 kit docs
in companion PR #25467.
> [!NOTE]
> While this PR does not hinge on a schemaVersion 2 public release, it
does assume that the built-in agents are migrated to schemaVersion 2.
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
As of v0.35.0, virtiofs caching is enabled by default on all operating
systems.
Previously it was opt-in on Windows.
Release notes: https://github.com/docker/sandboxes/releases/tag/v0.35.0
> Enable virtiofs caching by default on all operating systems for faster
> filesystem performance (`DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE=0` to
opt out).
Upstream change: docker/sandboxes#3882
### `architecture.md`
Adds a note in the "Storage and persistence" section that virtiofs
caching
is on by default everywhere, with a brief description of what it does
and
the `=0` opt-out.
### `troubleshooting.md`
Removes the platform distinction and the Windows `=1` opt-in example
from the
"Filesystem operations are slow" section. Keeps the `=0` kill switch and
the
Git index corruption note.
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
<!--Delete sections as needed -->
## Description
v0.35.0 adds SOCKS5 upstream proxy support and a companion exclusion
variable.
Release notes: https://github.com/docker/sandboxes/releases/tag/v0.35.0
> The sandbox proxy can chain upstream egress through a SOCKS5 proxy
> (`socks5://` / `socks5h://`, with optional auth) via
`DOCKER_SANDBOXES_PROXY`.
> Add `DOCKER_SANDBOXES_NO_PROXY` to exclude destinations from
> `DOCKER_SANDBOXES_PROXY`.
Upstream changes: docker/sandboxes#4041 (SOCKS5 transport),
docker/sandboxes#4056 (DOCKER_SANDBOXES_NO_PROXY)
Updates the "Upstream proxy" section of `architecture.md`:
- Documents `socks5://` and `socks5h://` scheme support, including the
DNS resolution distinction between the two
- Documents credential embedding in the URL
(`socks5://user:pass@host:port`)
- Adds `DOCKER_SANDBOXES_NO_PROXY` with a note clarifying it applies
only
to `DOCKER_SANDBOXES_PROXY` traffic, not `HTTP_PROXY`/`HTTPS_PROXY`
- Removes the "only HTTP and HTTPS traffic can be forwarded" limitation
bullet, which is no longer accurate with SOCKS5
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
<!--Delete sections as needed -->
## Description
v0.35.0 revamps policy tooling with a new default output format for
`sbx policy ls`, a new `sbx policy inspect` command, and a new
`sbx policy check network` command for testing policy before running an
agent.
Release notes: https://github.com/docker/sandboxes/releases/tag/v0.35.0
> `sbx policy ls` now shows a concise one-row-per-policy overview by
default.
> Use `--wide` for the previous rule-level table (now including rule
IDs),
> `--json` for automation, and the new `--source`/`--decision` flags to
filter.
> Detailed inspection moved to the new `sbx policy inspect
<policy-or-rule>`
> command.
Upstream changes: docker/sandboxes#3733 (policy ls revamp + policy
inspect),
docker/sandboxes#4018 (dhi.io HTTP in Balanced preset)
### `governance/monitoring.md`
- Rewrites all `sbx policy ls` example output blocks to the new
per-policy
format (`POLICY`, `SOURCE`, `APPLIES TO`, `SUMMARY` columns)
- Rewrites column descriptions for the new schema
- Updates the org governance header from the old multi-line block format
to the
new single inline summary line
- Adds mentions of `--wide`, `--source`, `--decision`, and `sbx policy
inspect`
### `governance/local.md`
- Adds a new "Testing policy" section documenting `sbx policy check
network`
with examples for allowed and denied targets, URL inputs, and the
`--sandbox` scope flag
- Updates the `sbx policy ls` reference to mention the new `--source`,
`--decision`, and `--wide` filters and `sbx policy inspect`
- Notes the v0.35.0 Balanced preset additions: VS Code domains,
`*.blob.core.windows.net`, and `dhi.io` over HTTP
## Related issues or tickets
#25532: cli ref update
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
<!--Delete sections as needed -->
## Description
As of v0.35.0, `sbx rm` refuses to delete a sandbox that has an active
session (an open attach, SSH connection, or in-flight SFTP transfer)
unless
`--force` is passed:
sandbox 'x' is in use (e.g. an open SSH connection); close it or re-run
with --force
Updates two files:
- **`usage.md`** — adds a `--force` note after the basic workflow
example;
updates the "clean slate" snippet to `sbx stop` first so the session is
cleanly closed before `sbx rm`
- **`get-started.md`** — updates the clone-mode setup snippet to `sbx
stop`
first; adds a `--force` note in the Clean up section
Release notes: https://github.com/docker/sandboxes/releases/tag/v0.35.0
> `sbx rm` now won't delete an active session unless `--force` is
passed.
Upstream change: docker/sandboxes#4035
## Related issues or tickets
#25532: cli ref update
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
<!--Delete sections as needed -->
## Description
`sbx kit add` no longer injects a kit into a running sandbox in-place.
As of
v0.35.0, it recreates the sandbox container with the updated kit set. VM
state
(installed packages, Docker images, volumes, agent history) is preserved
across
the recreation, and the kit's network rules take effect immediately.
Updates three places in `customize/kits.md` that described the old
injection
behavior:
- The mixin kit section note (was: "apply changes without recreating")
- The `[!IMPORTANT]` callout in the Using kits section
- The `sbx kit add` usage example under the Local subsection
Upstream changes: docker/sandboxes#3679 (core swap-recreate
implementation),
docker/sandboxes#3995 (network policy fix for swap containers)
## Related issues or tickets
#25532: cli ref update
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Description
Clarify that Compose v5 uses the same Docker Compose CLI command and is
functionally identical to Compose v2. Link to the existing Go SDK
documentation for the primary distinction.
## Related issues or tickets
Closes#25529
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
### Description
Removes the empty `Docker@2` step from the Azure DevOps example in the
Docker Scout generic CLI integration guide. The following script already
passes the documented Docker Scout credentials into the Scout CLI
container, so the standalone task line has no inputs and would fail if
copied as-is.
Fixes#25084.
### Validation
- `git diff --check`
- `npx markdownlint-cli
content/manuals/scout/integrations/environment/cli.md`
`./scripts/lint.sh
content/manuals/scout/integrations/environment/cli.md` also ran
markdownlint clean, then stopped because `vale` is not installed in this
local environment.
## Description
Follow-up to #25338 (the guides revamp). That PR collapsed most
multi-page guide series into single pages but left ~50 guides wrapped in
a `<name>/index.md` directory structure alongside guides that are
already flat `<name>.md` files — an inconsistent mix. This PR finishes
the flattening:
- Flattens 50 folder-wrapped guides to `content/guides/<slug>.md` via
`git mv` (history preserved). These keep the same URL, since Hugo
generates the same permalink for a leaf-bundle `dir/index.md` and a flat
`dir.md`.
- Moves the last 4 guides' local per-guide image bundles
(`genai-leveraging-rag`, `genai-video-bot`, `genai-claude-code-mcp`,
`java`) into the shared `content/guides/images/` folder with
slug-prefixed filenames, matching the convention already used by most
other guides (`databases-1.webp`, `kafka-1.webp`, etc.), and rewrites
the in-body image references.
- Normalizes `genai-claude-code-mcp`'s non-standard filename
(`claude-code-mcp-guide.md`) and capitalized `Images/` folder to match
convention.
- Promotes `content/guides/frameworks/laravel/index.md` to a top-level
`content/guides/laravel.md`, since it was the only guide under
`frameworks/` and every other language/framework guide is flat.
- Adds `aliases` entries for the two URLs that actually changed
(`/guides/frameworks/laravel/` and
`/guides/genai-claude-code-mcp/claude-code-mcp-guide/`); every other
rename preserves its existing URL.
Companion PR establishing this as the documented convention going
forward: #25503
## Validation
- `hugo --minify` build via `docker compose run` completes with zero
warnings/errors (3174 pages, 1524 aliases — unchanged from before this
PR).
- Verified both changed-URL guides render at their new path and the old
path 301s via the Hugo alias redirect.
- Verified every image reference in the 4 migrated guides resolves to an
existing file in `content/guides/images/`.
- Multi-agent docs review (link-checker, cross-reference-checker,
guide-conventions) found zero issues.
## Related issues or tickets
Discussed in the team's docs Slack channel following #25338.
## Reviews
- [ ] Technical review
<!--Delete sections as needed -->
## Description
Removed broken anchor xref link. The linked topic now focuses on local
policies as the dashboard policies are deprecated.
The workflow itself is still applicable until the scout policy dashboard
is fully retired. This topic will be updated soon with a local policy
workflow, once it's released.
## Related issues or tickets
https://docker.slack.com/archives/C0989V6TAK0/p1783443339779409
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
The Dynamic MCP dedicated page marks the feature as experimental, but the
MCP Catalog and Toolkit overview listed it as a standard feature with no
caveat. Note the experimental status in the overview card description so
the two pages are consistent.
Fixes#25259
<!--Delete sections as needed -->
## Description
Update policies based on available local policies.
DHI policy is not available locally.
## Related issues or tickets
https://docker.slack.com/archives/C0989V6TAK0/p1783441525250429
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Description
Aligns `content/manuals/dhi/migration/migrate-from-ubuntu.md` with the
phrasing used in the other DHI migration guides (`checklist.md`,
`migrate-from-doi.md`):
- `non-root user` → `nonroot user` in the DHI column prose (3
occurrences), matching the UID 65532 `nonroot` user naming used
elsewhere. The generic "others as non-root" description of Ubuntu base
images is left unchanged.
- "listen on port 1025 and up" → "listen on port 1025 or higher",
matching the other guides.
Fixes#25508Fixes#25510
## Reviews
- [ ] Technical review
- [ ] Editorial review
Co-authored-by: Niels Kaspers <github@nielskaspers.com>
<!--Delete sections as needed -->
## Description
Update the new scout GHA examples based on testing.
- Added organization.
- Added specific version as v1 is currently pinned to v1.20.4, which
predates policy-config support (added in v1.23.0).
Fixed redirect issue
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
<!--Delete sections as needed -->
## Description
Added release note for Cloudsmith integration with Hub. No how-to as the
user-facing portion is configured on third-party.
## Related issues or tickets
ENGDOCS-3320
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
- [ ] Product review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
<!--Delete sections as needed -->
## Description
Fixed a broken link.
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [x] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
## Summary
Fixes#25494.
The issue flags the organization-ownership prerequisite in the
create-company guide as misleading, on the premise that the steps only
create an empty company. Checking this page's history shows the premise
isn't quite right: before the admin IA restructures, the guide read
"navigate to the organization you want to place under a company" and
"review the company migration details" — creating a company migrates the
selected organization under it, which is why step 5 still says "Review
the migration details."
What actually got lost in the restructures is the sentence saying so.
This PR restores that clarification instead of removing the (correct)
prerequisite:
- Step 1 now says to select the organization you want to add to your
company, instead of the generic "select your organization".
- Added one sentence after the steps stating that the selected
organization is automatically migrated to the new company.
- Adjusted the follow-up link sentence to "add more organizations",
since the first one is added during creation.
## Validation
- `scripts/lint.sh content/manuals/admin/company/new-company.md` —
markdownlint clean.
- Cross-checked against `manage/organizations.md` (adding further
organizations) and the pre-restructure wording from #18940.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Description
Closes#25420.
Updates the enterprise deployment FAQ PowerShell example so it only
creates the `docker-users` group when the group does not already exist,
then adds the current user to it.
This keeps the example usable when the MSI has already created the local
group but did not populate it with the user account.
## Validation
- `git diff --check`
`docker buildx bake validate` was not run locally because Docker is not
installed in this shell.
Added a new resource for Docker learning focused on React.js
development, including a discount code.
<!--Delete sections as needed -->
## Description
Added a new resource for Docker learning focused on React.js
development, including a discount code. My book Docker for React.js
developers.
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [x] Editorial review
- [ ] Product review
---------
Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Single-sources the Docker Agent documentation from the product repo via
a Hugo module mount, joining the pattern used by CLI, Buildx, Compose,
BuildKit, Model Runner, and the Moby API. Closes the docs.docker.com
side of docker/docker-agent#3371.
## Context
The pages under `content/manuals/ai/docker-agent/` were hand-authored
duplicates of the product repo docs and drifted on every upstream
change. The source docs were converted to portable Hugo-clean Markdown
and prepared for mounting in docker/docker-agent#3413 and
docker/docker-agent#3414, released in docker-agent v1.96.0.
## What changed
| Change | Detail |
|---|---|
| `go.mod` | `github.com/docker/docker-agent v1.96.0` added to `require`
and `tool` |
| `hugo.yaml` | `module.imports` mounts the eight docs sections and
`demo.gif` onto `content/manuals/ai/docker-agent/` |
| Content | The 16 hand-authored pages are removed; `_index.md` stays
hand-authored (landing page), with links rewritten to the mounted pages
|
| `_vendor/` | 99 vendored files from the module |
| `.github/workflows/sync-docker-agent-docs.yml` | Daily poll that
vendors the latest docker-agent release and opens a bot PR, modeled on
`sync-cli-docs.yml` |
## URL preservation
Every removed page keeps its URL: the mounted pages carry `aliases`
front matter (added upstream in docker/docker-agent#3414), and
`_index.md` keeps aliases for the removed section indexes
(`integrations/`, `reference/`, `reference/examples/`).
| Old URL | Redirects to |
|---|---|
| `/ai/docker-agent/tutorial/` | `.../getting-started/quickstart/` |
| `/ai/docker-agent/best-practices/` | `.../guides/tips/` |
| `/ai/docker-agent/evals/` | `.../features/evaluation/` |
| `/ai/docker-agent/local-models/` | `.../providers/local/` |
| `/ai/docker-agent/model-providers/` | `.../providers/overview/` |
| `/ai/docker-agent/rag/` | `.../tools/rag/` |
| `/ai/docker-agent/sharing-agents/` | `.../concepts/distribution/` |
| `/ai/docker-agent/integrations/{a2a,acp,mcp}/` | `.../features/a2a/`,
`.../features/acp/`, `.../tools/mcp/` |
| `/ai/docker-agent/reference/{cli,config,toolsets}/` |
`.../features/cli/`, `.../configuration/overview/`,
`.../configuration/tools/` |
| `/ai/docker-agent/integrations/`, `/ai/docker-agent/reference/`,
`/ai/docker-agent/reference/examples/` | `/ai/docker-agent/` |
## Mount scope
All eight sections are mounted rather than a core subset:
`refLinksErrorLevel: ERROR` makes partial mounts fail the build for any
relative link into an unmounted page, and the link closure from the core
sections already pulls in 68 of the 90 pages. Mounting everything keeps
the build link-safe and removes all drift.
## Keeping the pin fresh
On each docker-agent release, `sync-docker-agent-docs.yml` (daily poll,
mirrors `sync-cli-docs.yml`) compares the latest release tag against the
pinned version and opens a bot PR with the re-vendored module.
docker/docker-agent also runs `validate-upstream.yml` on every docs PR,
so upstream changes that would break this site fail CI before they merge
(two source-side issues were caught exactly this way while preparing
this change).
## Validation
`docker buildx bake validate` passes on this branch:
| Target | Result |
|---|---|
| test (Hugo build + htmltest) | pass (3196 pages, 1515 aliases, 3110
documents tested) |
| lint | pass |
| unused-media | pass |
| test-go-redirects | pass |
| validate-vendor | pass |
| dockerfile-lint | pass |
`actionlint` passes on the new workflow.
<!--Delete sections as needed -->
## Description
Adding the Gordon gateway to allowlist.
https://docker.slack.com/archives/C0969D6AFSR/p1783062359137219
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [x] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
Document the image mount storage type: a new
content/manuals/engine/storage/image-mounts.md page following the
volumes/bind/tmpfs template, plus overview and cross-link updates in the
storage section.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
## What
Updates the built-in services table on the
[Credentials](https://docs.docker.com/ai/sandboxes/security/credentials/#built-in-services)
page so it matches what `sbx secret set` recognizes and the domains the
proxy actually injects credentials for.
- Add `cursor`, `droid`, and `openrouter` services
- Fix the `nebius` API domain (`api.studio.nebius.ai` →
`api.studio.nebius.com`)
- Expand the **API domains** column to the full set each service
authenticates for, instead of a single representative host (for example,
`anthropic` also covers `console.anthropic.com`, `claude.ai`, and
`mcp-proxy.anthropic.com`)
- Remove the `aws` row — that service can't authenticate a Bedrock
request and is being removed at the source
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
Adds a FAQ entry to the Docker Sandboxes docs listing the domains
organizations need to allow through a firewall or proxy so the `sbx` CLI
can authenticate, pull images, and upload diagnostics. Modeled on the
existing Docker Desktop allowlist page.
Generated by Claude Code
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
