Automated crawlers had no dedicated trap route in the docs site. Add a hidden site-wide footer link to a noindex page whose existing Marlin pageview identifies requests.
Co-Authored-By: Codex <codex@openai.com>
Agentic Platform child pages remained visible to generated discovery indexes because only the section root disabled sitemap output.
Cascade the sitemap setting and reveal hidden descendants only within the active sidebar branch.
<!--Delete sections as needed -->
## Description
Added back the attribute `external` in the `/reference/compose/secrets`
section with a warning that this attribute is only available for Docker
Swarm. Additionally, I added a small toy reference example to the
section "Defining and using Secrets in compose files" and moved the
section outside of the "Examples" section. The reason why I did this is
because I noticed the Examples are all runnable steps that showcase
concrete usage of secrets, the example I added is just a
skeleton/reference to how they should be used in conjunction with
`docker secret create...`, not a true able-to-run example like the ones
below. I also changed the hyperlink from
`/reference/compose-file/legacy-versions.md` to
`/reference/compose-file/secrets.md`.
A few caveats that I wasn't sure about when writing this:
- I'm not sure if using the "[!NOTE]" in the attributes list is the
approach maintainers and writers might favor and I can change it
accordingly
- I'd love to hear feedback on moving "Defining and using secrets in
compose files" outside of "Examples" due to my reasoning above
Edit:
I'm also not opposed to making a fully working example using compose,
stack and secrets and putting the section back under `Examples`
<!-- Tell us what you did and why -->
## Related issues or tickets
#25491
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
## Summary
Adds the Docker Agentic Platform plan page and related billing cycle
updates. The page stays published and linkable, but is unlisted from
nav, search, and the plans grid.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Usha Mandya <47779042+usha-mandya@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>
build.network was showing `custom_network_1`, which looks like a
user-defined Compose network. it's the RUN networking mode (`default` /
`none` / `host`), same as `docker build --network`.
@netlify /reference/compose-file/build/
Fixes#21982
Signed-off-by: Dean Chen <862469039@qq.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
The t3code kit in sbx-kits-contrib installs the build toolchain and the
t3 npm package at sandbox creation, replacing the manual apt-get setup
as the recommended path. Keep the manual install as the fallback for
existing sandboxes.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Clarify that .sbxenv.yaml must stay outside the primary workspace and any additionalWorkspaces mounts, and make the direct-mount warning explicit in the field reference.
Change notes:
- content/manuals/ai/sandboxes/configuration/environment-files.md - clarify that environment files must stay outside every mounted workspace
Align DVP Starter/Growth reports and apply steps with the Hub landing
page and Insights docs, and adjust plan sidebar weights and linkTitles.
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Summary
Add a Docker Verified Publisher (DVP) plan page covering Starter and
Growth, including apply, tracked companies, and billing. Also list DVP
on the subscription overview and plans index.
Related: https://github.com/docker/docs/pull/25891 (product/program
updates; this PR covers billing and subscription workflows)
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
The kit reference did not state that setup.files runs as the non-root agent user. Document the UID 1000 write restriction and direct root-owned path writes to setup.install.
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
## Description
The sbxenv docs
[document](https://docs.docker.com/ai/sandboxes/sandbox-environments/#workspace)
the direct mount risks, mirroring them here for completeness.
## Related issues or tickets
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [x] Editorial review
- [x] Product review
T3 depends on node-pty, which has no Linux prebuilds, so a sandbox
needs a compiler, make, and python3 for the first connection to
succeed. Adds this as a prerequisite and expands the "server never
becomes ready" troubleshooting section to distinguish a missing
toolchain from a full disk, since both produce the identical error.
Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
T3 Code connects to sandboxes over the same SSH integration as VS
Code and Cursor, with no dedicated Docker Sandboxes support on its
side. Adds a Connect page plus a disk-space troubleshooting note for
the "server never became ready" timeout.
Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
Addressing some staleness on the custom roles permissions doc. While in
the area, decided to make updates to the area so it scales out more.
Need to add that it's Business plans only
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
The kits guide did not cover the Sigstore signing support added in docker/sandboxes#4446. Document keyless and key-based workflows, OCI sign-on-push, signature enforcement, and the signed-content boundary.
Co-Authored-By: Claude <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
The Compose Bridge Model Runner page said `enabled: false` means “no
Docker Model Runner resources are deployed,” which clashes with the
Desktop section that still points workloads at the host Model Runner.
Clarified that the zero-replica note is only about the in-cluster
deployment.
Fixes#25485
Signed-off-by: Dean Chen <862469039@qq.com>
The Linux installation section appeared to apply to unsupported Ubuntu derivatives and described all release artifacts as binaries. Clarify the supported Ubuntu path, link to artifact instructions with a support disclaimer, and use apt for interactive package installation.
Co-Authored-By: Codex <noreply@openai.com>
## Description
The Sandboxes credential pages describe the keychain-less Linux fallback
as "an encrypted file" and quote a CLI notice that no longer exists.
They also frame the fallback as weaker than an OS keychain only because
a keychain "mediates access per application".
Both understate it. The file is encrypted with a key compiled into
`sbx`, not a secret the user holds, so anyone who can read the file can
decrypt it. What actually protects it is the `0700` directory mode —
which the pages already mention, so this mostly moves the emphasis onto
the claim that holds.
`sbx` now prints:
```text
No keychain detected - this secret will be stored on disk, protected by file permissions rather than a password
```
replacing the previous "…stored in an encrypted file on disk". The
quoted strings here are byte-matched against the constant in the CLI.
Four passages change:
- `security/credentials.md` — the fallback description, the quoted
notice, and the protection claim
- `security/credentials.md` — the **Best practices** list, which
repeated "encrypted at rest in the OS keychain (or an encrypted file on
Linux hosts without a keychain)"
- `faq.md` — the headless-Linux entry, which carried the same notice and
claim
No behaviour or feature is being documented here — only the accuracy of
an existing description.
## Related issues or tickets
The CLI-side change is in `docker/sandboxes` and ships in the next
release. Worth holding this until that release is out: until then the
page would quote a notice users don't see yet.
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Two things a reviewer may want to weigh in on:
- **Tone.** The intent is to be accurate without being alarming: it
states what protects the file and what the encryption does and does not
give you, rather than editorialising about weakness. Happy to soften or
sharpen.
- **Adjacent advice, unchanged here.** The FAQ paragraph immediately
below the edited text tells headless users to install `gnome-keyring`
and start `dbus-run-session`. A *locked* Secret Service collection is
known to make `sbx` commands hang rather than fall back, and on a
key-only SSH host locked is the default state after the keyring daemon
restarts — so that advice can land users somewhere worse than the
fallback. It is left alone because the underlying issue is being worked
separately, but it may deserve a caveat once that is resolved.
<sub>Investigated, authored and posted by Claude Code on behalf of
@robmry.</sub>
Signed-off-by: Rob Murray <rob.murray@docker.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
