Refresh on top billing docs :)
TO DO:
Confirm Docker Offload situation
Remove random link to Testcontainers (?)
Review that Manage your plans h2 lol
Co-authored-by: Cursor <cursoragent@cursor.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
Cached template images and existing sandboxes need updates after the external eMudhra certificate authority compromise. Add guidance for recreating sandboxes with refreshed images or updating CA certificates in place.
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: aevesdocker <allie.sadler@docker.com>
Update Sandboxes documentation for current kit validation and signing
behavior, host Git-ignore snapshots, cloud proxy support, and browser
and daemon logging settings. Correct SSH workspace, policy refresh,
automation, environment merging, and T3 toolchain guidance.
Keep offline checks alongside kit validation and inspection, consolidate
proxy explanations, and make toolchain installation conditional.
Preserve the upstream explanation of kit context files.
Regenerate the published v0.49.1 release notes and vendor the CLI YAML
from docker/sandboxes release/v0.49.
Each atomic change has its own commit. Rebased onto main. Scoped
Markdown and Vale checks, the Hugo build, and diff whitespace checks
passed. All 121 CLI YAML files parse and match upstream exactly.
Generated by Codex
Full template contents and T3 prerequisites did not reflect the included C/C++ toolchain. Document the tools and make manual installation conditional on missing dependencies.
Environment merging guidance could imply a later override repairs invalid input. Explain that every source file, including user defaults, must be valid before merging.
The automation guide did not identify quiet output for policies, settings, or approvals. List the returned identifiers and distinguish cloud policy output.
Automation guidance did not cover secret removals that match no stored entry. Explain the nonzero result and checking for matching secrets before cleanup.
Proxy guidance excluded host connections to cloud sandboxes. Document their proxy scope and the direct cloud SSH setting, and link the cloud SSH workflow to that guidance.
Git workflows did not explain how host ignore decisions reach local sandboxes. Document the creation-time snapshot and its limits without implying that ignored files are inaccessible.
The integration guide suggested SSH shells might start outside the primary workspace. State that interactive SSH starts in the sandbox workspace while editor folder pickers can choose another location.
The signing instructions did not account for Git changing signed file contents. Explain the signing warning and why local verification does not establish that committed bytes match.
Kit authors lacked guidance for checking local sources without a daemon or sign-in. Document offline validation and inspection, including the policy checks they skip.
## Description
Orca is an agent development environment that runs coding agents in
parallel,
each in its own git worktree. It connects to a sandbox as a plain SSH
host and
installs its own relay inside it, so this works today with no changes on
either
side, and nothing documents it yet.
The page covers the SSH target fields (including the `_default_user_`
username), the C++ compiler Orca's remote terminals need, how agent
selection
works, and credential injection. It follows the shape of the T3 Code
page.
A separate change adds a C/C++ toolchain to the full sandbox templates.
Template
images publish independently of an `sbx` release, so the manual install
here
stops being necessary as soon as the new images carry the toolchain, and
I'll
follow up to drop it once I can pull one that does.
The T3 Code page gets the same one-line change, since it documents the
same
manual install and should name the same package.
Left out deliberately: Orca also offers an "Orca-managed Node" runtime
per SSH
target, which uploads its own Node and needs no compiler at all. I have
not
tested that path against a sandbox, so it stays out until I have.
## Related issues or tickets
- https://github.com/stablyai/orca/issues/13665
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Manuel de la Peña <manuel.delapena@docker.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Description
The Offload CLI prints `https://docs.docker.com/go/get-offload` when an
account has no Offload access. This PR changes where that short link
goes.
- Before: `https://app.docker.com/billing/catalog`, added in #26303.
- After:
`https://app.docker.com/billing/subscription/dap/compute?returnTo=https://docs.docker.com/offload/quickstart/&ref=cli&refAction=NotEntitled`.
The new target opens the Offload checkout directly. It asks the user to
log in first, then sends them to the checkout of their personal account.
A user who already has Offload skips checkout. After checkout, the user
returns to the Offload quickstart.
`ref=cli` and `refAction=NotEntitled` tell the app-ui checkout events
that the visit came from the CLI. The checkout keeps both params on
every step through to the success page. This lets us measure the Offload
sign-up funnel from the CLI. The app-ui changes are
docker/frontends#17539 and docker/frontends#17544, and both are in
production.
## Related issues or tickets
- DCL-2208: make the Offload web sign-up funnel measurable from end to
end.
- #26303 added the current `/go/get-offload/` redirect.
## Reviews
- The redirect handler (`hack/releaser/cloudfront-lambda-redirects.js`)
already supports targets with a query string, for example the `utm_*`
targets in the same file. It also appends any query params on the
incoming request.
- The checkout accepts `returnTo` only for HTTPS addresses on
`docker.com` hosts, so the quickstart address is accepted.
- To test after deploy, open `https://docs.docker.com/go/get-offload/`
while logged in to Docker. You land on the Offload checkout, and the
address has `ref=cli`.
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
## Summary
Replace the two JIT sign-in diagrams with one Mermaid flowchart, and
retitle the sections so setup, disable, and re-enable are distinct
tasks.
Agent readiness scores increased to 98, up from 94 for the live doc.
@netlify /security/provisioning/just-in-time/
Preview:
https://deploy-preview-26370--docsdocker.netlify.app/security/provisioning/just-in-time/
Generated by Cursor Grok
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
## Description
Add Docker Skills to the discovery links near the top of generated
`llms.txt`, and point the MCP link to
`https://ai-backend-service.docker.com/mcp` for direct access to the
Docker RAG server.
Changes the Hugo template only; the generated file is not checked in.
## Reviews
Verified the skills page returns HTTP 200 and the MCP endpoint
initializes as `gordon-rag`. Rendered the updated template with Hugo in
a minimal site and confirmed both discovery links appear in the
generated header. `git diff --check` passes. A full docs-site build was
not run.
- [ ] Technical review
- [ ] Editorial review
---------
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Documentation updates can be technically accurate yet unnecessary,
duplicated, or poorly placed. Update research to justify an edit through
the reader's task and a specific documentation gap, write to integrate
it into the existing page, and review-changes to assess reader value,
placement, and flow.
Keep the guidance in the existing skills, without a required reporting
template. Each skill update has its own commit.
Markdown checks pass; Vale reports only pre-existing findings outside
the edited lines. Skill validation passes after excluding unchanged
Claude-specific metadata unsupported by the Codex validator.
Generated by Codex
<!--Delete sections as needed -->
## Description
Adds a Mac troubleshooting topic for containers that can reach the
internet but not devices on the local network (LAN). The cause is Docker
Desktop not having the macOS **Local Network** permission: macOS then
blocks container traffic to devices on the local network, including the
router, while internet traffic still works. The fix is turning on Docker
in **System Settings** > **Privacy & Security** > **Local Network**,
which takes effect immediately, without restarting Docker Desktop.
Also adds a short **Local Network permission** section to the Mac
permission requirements page that links to the new topic, since that
page didn't mention it.
**Verified** on macOS 26.7 / Docker Desktop 4.92.0 by toggling Local
Network for Docker:
- Off: containers couldn't reach LAN peers or the default gateway (ping,
TCP, UDP DNS), while the internet and `docker pull` kept working.
- On: access came back immediately, on the same backend process, without
restarting Docker Desktop.
- **On a fresh install, macOS prompts for the Local Network permission,
so users who hit this have most likely denied that prompt at some
point.**
## Related issues or tickets
- https://github.com/docker/desktop-feedback/issues/636
## Reviews
- [ ] Technical review @mat007
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
Generated reference pages without modification dates appeared in the sitemap with lastmod set to 0001-01-01. Only render lastmod when the page has a nonzero date.
## Description
Fixes#26385.
Correct the incomplete sentence in the Compose variable interpolation
guide so the relationship between `.env` variables and container
environment variables is clear.
## Validation
- `git diff --check`
- Scoped repository lint was unavailable because the pinned local
dependencies are not installed.
## Summary
Custom secret injection is limited to HTTP request headers, but the
credentials page recommended it for secrets in request bodies and
described replacement anywhere in a request. Remove that use case and
clarify the header-only restriction.
@netlify /ai/sandboxes/configuration/credentials/
Generated by Codex
## Description
Explain how the generated Kits section points agents to each kit's
guidance, including packaged context files under
`/usr/share/sandbox/kit/<stem>/` and the location of inline
instructions.
@netlify /ai/sandboxes/customize/use-kits/
Generated by Codex
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Signed-off-by: aevesdocker <allie.sadler@docker.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: aevesdocker <allie.sadler@docker.com>
