<!--Delete sections as needed -->
## Description
This PR adds a GitHub Actions workflow to automatically mark and close
stale issues and PRs, helping maintainers focus on active items. The old
app/bot stopped working around mid 2025 and was disabled. This
reimplements it using a GitHub Action with additional slash command
functionality.
### Timeframes
- **Mark as stale**: After **180 days** (6 months) of inactivity
- **Close stale issues**: After **14 additional days** of no activity
- **Close stale PRs**: After **30 additional days** of no activity
### Exempt Labels
Issues and PRs with any of these labels will never be marked as stale:
- `kind/help-wanted`
- `status/need-more-info`
- `status/needs-analysis`
- `lifecycle/frozen`
### How to Keep Issues/PRs Active
To prevent an issue or PR from being marked as stale or closed:
**Anyone can:**
1. **Add a comment** - any comment resets the inactivity timer
2. **Use `/lifecycle active`** - removes the stale label via slash
command
**Maintainers can also:**
3. **Use `/lifecycle frozen`** - prevents the issue/PR from ever being
marked stale
4. **Add exempt labels** - manually apply one of the labels listed above
5. **Make any update** - editing the description, adding labels, or any
activity resets the timer
### Slash Commands
The workflow supports these lifecycle commands (comment them on any
issue/PR):
| Command | Access | Description |
|---------|--------|-------------|
| `/lifecycle active` | Anyone | Removes the stale label |
| `/lifecycle frozen` | Write access required | Prevents stale marking |
| `/lifecycle stale` | Write access required | Manually marks as stale |
| `/remove-lifecycle frozen` | Write access required | Removes frozen
label |
| `/remove-lifecycle stale` | Anyone | Removes stale label |
Commands respond with a 👍 reaction when successful, 👎 when permission is
denied.
### Messages
When marked as stale, issues and PRs receive a friendly comment
explaining:
- The situation and timeline for closure (14-30 days)
- How to remove the stale label using `/lifecycle active`
- How maintainers can freeze with `/lifecycle frozen`
### Debug Mode
The workflow is currently set to **debug mode** for both components:
**Stale action** (`debug-only: true`):
- ✅ Runs and logs what actions it would take
- ❌ No actual changes will be made (no labels, comments, or closures)
**Lifecycle commands** (`DEBUG_ONLY: 'true'`):
- ✅ Logs what would happen when slash commands are used
- ❌ No labels added, removed, or permission checks enforced
## Related issues
- #19050
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Summary
Standardize the Docker Scout CLI command on `docker scout` (with space)
across the CircleCI and Jenkins integration guides so it matches the
format used in `azure.md`, `gitlab.md`, and the rest of the Scout docs
(`install.md`, `quickstart.md`, `gha.md`).
## Issue
Fixes#24843
## Changes
- `content/manuals/scout/integrations/ci/circle-ci.md`: change
`docker-scout cves …` to `docker scout cves …`
- `content/manuals/scout/integrations/ci/jenkins.md`: change
`docker-scout cves …` to `docker scout cves …`
Other references to `docker-scout` that are not CLI invocations (the
binary filename in `install.md`, the GitHub Action step `id:
docker-scout` in `gha.md`, external URLs, and Azure resource names) are
intentionally left unchanged.
## Testing
- Docs-only change. Diff is two lines, no content rewrites.
Signed-off-by: Niels Kaspers <kaspersniels@gmail.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
The code snippet for Dockerfile under the "Using the official Docker
images" contains a comment which says that this Docker file uses DHI
image, which is incorrect.
<!--Delete sections as needed -->
Updated the code snippet to match the tab contents
<!-- Tell us what you did and why -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Fixes#24818.
The `[!IMPORTANT]` callout at the top of
`content/manuals/dhi/how-to/build.md` read:
> You must authenticate to the Docker Hardened Images registry
(`dhi.io`) to pull base images and build tools. [...]
Phrased that way it reads as if any Dockerfile using a DHI base image
(e.g. `FROM dhi.io/python:3.13`) needs a special authentication step
specific to the build page. The real reason is scoped: the DHI build
frontend itself pulls from `dhi.io` when processing a YAML definition
file.
Rewritten to tie the requirement explicitly to the DHI build system and
to the act of building a definition file, so readers don't extrapolate
the requirement to unrelated Dockerfile usage. Wording around the Docker
ID credentials is preserved.
Fixes#24819.
In `content/manuals/dhi/how-to/customize.md` the Docker Hub tab jumped
from "select the repository / select the tag" straight to "images later
in the list will overwrite files from earlier images" without first
establishing that multiple OCI artifacts can be added or how their
ordering is determined in the UI. Readers understood the consequence but
not the mechanism.
Adds one short paragraph before the overwrite rule to anchor the reader:
- multiple OCI artifacts can be added to a single customization,
- they're applied in the order they're added in the **OCI artifacts**
drop-down.
The overwrite rule is rephrased to:
- refer to "images added later / images added earlier" for consistency
with the new paragraph,
- use "If multiple images contain directories or files with the same
path" (the rule applies to any N≥2, not just two),
- use "directories or files" instead of the existing "directories and
files", which could be read as requiring both types in the same artifact
for the rule to apply.
No change to the subsequent paragraphs about include/exclude paths.
Fixes#24743.
The authentication note at the top of
`content/manuals/dhi/migration/examples/python.md` was the stripped-down
version, missing:
- the indication that `docker login dhi.io` expects Docker ID
credentials
- the detail that those are the same credentials as Docker Hub
- the link to the account creation page
The equivalent notes in `go.md` (lines 24-29) and `node.md` (lines
24-29) carry all three. This PR copies the full paragraph into
`python.md` so Python readers get the same onboarding guidance.
No other content changed.
Fast follow ups:
- Returned aliases with new alias to one doc
- Updated provision index page to accurately reflect different methods
- reorganized table to reflect popularity of methods based off sme info
(scim is the vogue, then JIT, then auto provision)
- Updated grid to link correctly to auto provisioning doc
- Created more opinionated left nav to reflect recommendations around
security SCIM > JIT > auto
- Fixed `*`s to be `-`s
- Updated Migrate doc heading levels
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Adds a troubleshooting note on the Fedora install page for the case
where the Docker service fails to start with `failed to find iptables`
in the logs, pointing users to set the `iptables` alternative to
`iptables-nft`.
Closes#23186
<!--Delete sections as needed -->
## Description
Adds documentation for `network_mode: bridge` in the Compose file
reference.
While `bridge` is a valid and functional network_mode option that
connects
containers to the host's default bridge network, it was not documented
alongside the other options (none, host, service, container).
Fixes#24742.
- #24742
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [x] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Mahitha Adapa <mahitha.ada@gmail.com>
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
Publish an MCP Server Card at /.well-known/mcp/server-card.json
pointing at https://mcp-docs.docker.com/mcp, so agents doing MCP
discovery can find the official Docker docs endpoint. Mirror the
serverInfo and capabilities reported by the server's initialize
response.
Also add a one-line pointer near the top of llms.txt so LLMs fetching
the index learn about the structured-access alternative.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The `security_opt` field in the Compose services reference did not
document
the accepted syntax variants, which was confusing for users.
Added a note explaining that options accept `option=value`,
`option:value`,
or bare `option` syntax (for booleans). Added examples showing all three
equivalent forms for `no-new-privileges`.
Add Content-Signal directive opting in to AI training, search indexing,
and AI input (RAG/grounding). Docker's official docs benefit from wide
distribution through AI assistants, so permitting training and grounding
is aligned with the site's purpose.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The CloudFront Lambda rewrote `/` with `Accept: text/markdown` to an
invalid `.md` URI, causing a 502 LambdaValidationError. Homepage has no
flattened markdown equivalent, so route to `/llms.txt` — the
agent-oriented markdown index of the site. Same handling for
`/index.html`.
Also set `Content-Type: text/markdown` on `llms.txt` at upload time, so
content negotiation responses and direct requests both advertise the
correct media type.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
## Description
The `release-notes-pr-trigger` workflow was interpolating PR context
values
(`html_url`, `title`, `user.login`) directly into a shell heredoc. A
specially crafted PR title or author name could break out of the JSON
string
and execute arbitrary commands.
This change moves the GitHub context values into environment variables
and
uses `jq` to safely construct the JSON artifact, eliminating the
injection
vector.
## Related issues or tickets
None
## Reviews
- [x] Technical review
Signed-off-by: Lorena Rangel <lorena.rangel@docker.com>
The option is parsed as a boolean by strconv.ParseBool, so 'disabled'
wasn't a valid value and misled readers. Align the default with the
in-file convention used by max-size and max-file.
Closes#21898
<!--Delete sections as needed -->
## Description
- Remove tier badges from all DHI topics except `/dhi/features/` since
the summary bar already conveys subscription tier info
- Update tier badges in `/dhi/features/` from `&` to `or` to match the
prose and clarify that either DHI Select or Enterprise provides the
feature
- Add summary bars to sections in `cli.md` and `hardened-packages.md`
that previously only had badges
- Add new `Docker Hardened Images Enterprise` summary bar variant for
Enterprise-only sections
## Related issues or tickets
Closes#24732
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Summary
- Clarify that `/etc/sandbox-persistent.sh` is sourced when bash runs
inside
the sandbox, but not when `sbx exec <name> <command>` runs a command
directly without a shell. Add a `bash -c` workaround.
(Related: docker/sbx-releases#53)
- Add FAQ entry explaining why agents run without approval prompts (the
sandbox is the safety boundary) and how to re-enable them: change the
permission mode inside the session, or build a custom template.
(Related: docker/sbx-releases#47)
- Add a note to the network policy page and a troubleshooting entry
making
it explicit that SSH and other non-HTTP protocols are always blocked,
regardless of allow rules. (Related: docker/sbx-releases#46)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
