Lots of changes here.
- There's one instance of "tier" that appears in the Gordon UI. I
preserved that verbiage to match the UI.
- AI Governance billing behaviors and usage are currently sales-led.
Docs reflects this, but includes many link outs to product docs.
- **PLEASE READ**:
- Manage plans includes procedures for setting up a new plan, or
upgrading a plan.
- However, because the language of downgrade/cancelation+cancel
auto-renewal varies plan-to-plan with little overlap, I independently
documented that language and those procedures on the plan-specific page.
- This decision was made along two principles: first, not duplicating
shared procedures across many user flows (this is true for first time
self-serve and upgrade steps; I have validated both); second,
maintaining specificity about what "canceling" does and matching that UI
language closely.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
## What
A full revamp of the `/guides` section — taxonomy, structure, and UX.
Preview: https://deploy-preview-25338--docsdocker.netlify.app/guides/
### Taxonomy & structure
- Replaces the sprawling 24-tag set with a focused 9-tag taxonomy
aligned to use case / SDLC: **Languages & frameworks, AI, Testing,
CI/CD, Security, Databases, Deployment, Admin, Hands-on labs**.
- Removes the languages taxonomy entirely (`data/languages.yaml` and all
`languages:` front matter).
- Collapses all multi-page guide series into single pages, with aliases
so old sub-page URLs continue to resolve.
- Deletes redirect-only shim pages and flattens directory-wrapped single
pages.
### Landing page (`/guides/`)
- A clean index: hero, then category sections listing each guide as a
plain **title / summary** row.
- **Browse rail** (sticky, left): click a topic to filter the page to
just that topic's guides; "All guides" resets. A count + Clear bar
appears while filtering.
- **Text filter**: instant client-side search over title, summary, and
tags. Topic filter and text search are mutually exclusive and share the
same flat-list view.
- No more "Featured guides" section.
### Guide content pages
- Removes the left sidebar for the guides section (mobile drawer kept).
- Centered reading column (`92ch`) with the TOC taking the remaining
width.
- Summary rendered as a lead paragraph under the h1.
- TOC scrollbar auto-hides until hover; breadcrumbs render at a
consistent size inside and outside `prose`.
## Notes
- Deep full-text search across guide bodies is still handled by the
existing site-wide Pagefind (⌘K); the landing filter is the fast
metadata-narrowing surface.
- `series.html` is retained — it's still used by `get-started` pages.
## Validation
- Site builds clean locally (Hugo dev server, no errors / broken refs).
- All collapsed sub-page URLs redirect via aliases.
## Follow-ups
- Prune guides that we no longer need/want
- Tighten the guides that span too many concepts (e.g. language guides;
remove cicd/deploy/sscs)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Clarify that the Ubuntu 24.04 / noble example is only one
possible release choice and that readers should replace the
codename with the Ubuntu release they want to import.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
This PR captures changes made to the subscription/_index page. It
doesn't include future work for breaking /scale into individual product
subscription types.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary
The kit examples page covered tool installation and credential injection
but never showed how to customize the shell environment — sourcing a
tool's init script so its command lands on `PATH` in every shell. This
adds a "Customize the shell environment" section, documents
install-command gotchas that apply to any download-based kit, and fixes
a Vale rule that tripped on product names ending in `!`.
Two commits:
1. **docs: add shell environment customization to kit examples**
- Worked example uses **nvm** — it installs cleanly in a default sandbox
(reachable egress, no extra packages), so the snippet works as
copy-pasted. It appends to `/etc/sandbox-persistent.sh` — the sandbox's
persistent environment file, sourced for both interactive and
non-interactive shells — matching the FAQ convention for custom env
vars, and cross-links it.
- Install-command caveats added to the "Install a tool" section:
deny-by-default egress can silently block downloads; `curl … | bash`
masks those failures (exits `0`, sandbox reports success while nothing
installed); install steps run under `sh`, not bash; some tools need base
packages such as `zip`/`unzip`.
- The first draft's sdkman snippet was dropped as the primary example
because it fails silently in a default sandbox (blocked `get.sdkman.io`
egress + missing `zip`/`unzip`). Those failure modes are now documented
as general install-command guidance, with sdkman as the illustration.
2. **vale: exempt product names ending in '!' from Docker.Exclamation**
- `Docker.Exclamation` flags any word followed by `!` in bare prose,
tripping on product names like SDKMAN!. Link text and code were already
exempt via `IgnoredScopes`, but bare prose was not. Added an
`exceptions` list (matched against the word before the `!`) so genuine
exclamations are still caught.
## Learnings
- `/etc/sandbox-persistent.sh` is the canonical persistence point for
shell env in sandboxes — sourced before *every* bash invocation
(interactive and non-interactive), so it reaches agents started with
both `sbx run` and `sbx exec`. A `~/.bashrc` edit only covers
interactive shells.
- `curl … | bash` in an install command masks download failures: the
pipe's exit status is bash's, and bash exits `0` on empty input, so a
domain blocked by the deny-by-default egress policy still produces a "✓
Created" sandbox with nothing installed. Download-then-run (`-o file &&
bash file`) surfaces the failure.
- Kit install commands run under `sh` (dash), not bash — bash builtins
like `source` fail with `sh: source: not found` unless piped to `bash`
or wrapped in `bash -c`.
- nvm won't activate while `NPM_CONFIG_PREFIX` is set (the base image
sets it for its system Node); `unset NPM_CONFIG_PREFIX` before sourcing
`nvm.sh`.
- Vale's `exceptions` for an `existence` rule with `nonword: true` are
matched against the *word* preceding the non-word token, not the full
match — so a product name ending in `!` is listed without the `!`
(`SDKMAN`, not `SDKMAN!`). Go's RE2 engine also has no lookahead, so
token regexes can't use `(?=…)`.
Generated by Claude Code
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The sbx policy set-default command was renamed to sbx policy init in
the latest release. Update the non-interactive setup prose accordingly.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The `sbx policy ls` rendering changed: a `Policy rules` status block
(Governance/Sync/Hidden), columns `PROVENANCE APPLIES_TO POLICY/RULE TYPE
DECISION RESOURCES`, and a `STATUS` column that appears only with
`--include-inactive`. Update the monitoring.md examples and column docs, and
fix the header/inactive-status prose in local.md and audit.md to match.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add worked examples to the org policy page showing how org-wide and
team-scoped network rules combine: granting one team access to an
otherwise-blocked domain, blocking a domain everywhere as a guardrail,
and the distinction between an exact deny and a wildcard deny when a
team-scoped allow targets a subdomain.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Description
Clarifies the OpenVEX status reference by documenting all four standard
OpenVEX status values.
Updates the introduction to clarify that OpenVEX defines four status
values
while Docker Hardened Images (DHI) uses three of them, and adds the
missing
`fixed` status to the reference table with a pointer to the explanation
below.
## Related issues or tickets
Fixes#25433
## Reviews
* [x] Technical review
* [ ] Editorial review
* [ ] Product review
sbx v0.33.0 added linux/arm64 packages. Update the Linux prerequisites
to list aarch64 alongside x86_64, and extend the KVM module hint to
include kvm_arm64 and the bare kvm module used on some arm64 hosts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
## Summary
Fix misleading descriptions, stale tense, and contradictory statements
across admin, security, SSO, MCP profiles, and subscription scaling
documentation.
Closes#24893Closes#24894Closes#25024Closes#25058Closes#25261Closes#25300
Generated by Cursor (Claude)
Made with [Cursor](https://cursor.com)
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Description
Clarifies the wording in the "Persist the DB" workshop tutorial.
The volume is already created and named (`todo-db`) in step 1 using
`docker volume create`. The previous wording in step 3 suggested that
the volume was being named there, while the command actually uses the
existing volume as the mount source.
This change updates the wording to make the workflow clearer and more
technically accurate.
## Related issues or tickets
Fixes#25404
## Reviews
* [x] Technical review
* [ ] Editorial review
* [ ] Product review
## Description
Adds a note to the sandbox kit docs explaining that the sandbox manages
proxy environment variables (`HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`,
and lowercase equivalents) for the agent, and that kits shouldn't set
them.
Setting these in a kit routes traffic around the sandbox's built-in
forward proxy, which silently disables network policy enforcement and
credential injection. The note points to the [Upstream
proxy](https://docs.docker.com/ai/sandboxes/architecture/#upstream-proxy)
section for configuring an upstream corporate proxy on the host, keeping
the env-var details in one place.
Surfaced as a documentation suggestion in
[docker/sbx-releases#240](https://github.com/docker/sbx-releases/issues/240).
## Reviews
- [ ] Technical review
- [ ] Editorial review
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
## Description
Fixes#25406.
Updates the Docker Desktop networking how-to so the Windows backend
process name matches the overview page: `com.docker.backend.exe`. The
same sentence also now closes the parenthetical process list before the
explanatory clause.
## Validation
- `git diff --check`
Not run: `docker buildx bake validate`, because Docker is not installed
in this environment.
Fixes a broken link in Docker Desktop release notes.
The release notes referenced
`/desktop/windows/permission-requirements/`, which returns a 404 page.
This change updates the link to the current Windows permission
requirements documentation page.
## Related issues or tickets
Fixes#25401
## Reviews
* [x] Technical review
* [ ] Editorial review
* [ ] Product review
