## Summary
Refresh the vendored Sandboxes cookbook and OpenAPI reference from
upstream.
Removes standalone MCP gateway start/stop documentation, imports
upstream authentication and timeout examples, auto-resume readback
guidance, and network-policy selector updates, and regenerates the API
presentation data.
@netlify /ai/sandboxes-api/cookbook/give-a-sandbox-an-mcp-gateway/
Generated by Codex
API generation introduced in #26048 added roughly five minutes to site
builds: median successful main-branch build-workflow duration rose from
4m 05s to 8m 48s across September 3–25. The pre-build command took 4m
41s–4m 53s in each of four jobs on the merge commit.
Vendor the generated presentation model in `data/api-reference.json`,
mark it as generated, and let Docker, Netlify, and local Hugo builds
consume it directly. Keep the existing rendered-output checks.
Move generator tests, strict spec validation, and a byte-for-byte
regeneration check into `docker buildx bake validate-api-reference`,
inheriting the shared Docker base stage. The target uses the pinned
Vacuum release binary with Dockerfile ADD checksum verification and
archive extraction instead of compiling Vacuum from source. The existing
build workflow runs this target alongside the other validation matrix
entries. Only this matrix entry is advisory; its failures do not block
site builds or deployment.
Validated locally with the Docker target, rejection of deliberately
stale data, repeatable generation across directories, a production Hugo
build and verification of 453 API HTML/Markdown page pairs, workflow
syntax checks, and scoped documentation lint. The prebuilt-binary CI
check passed in 1m 40s, down from 5m 15s with source compilation. Remote
layer-cache settings were subsequently removed; local Go cache mounts
remain.
Generated by Codex
## Description
Add an experimental Sandboxes API and SDK section alongside Docker
Sandboxes under AI and agents, at `/ai/sandboxes-api/`. Cover
installation of `@docker/sandboxes`, browser and PAT authentication, and
a TypeScript walkthrough that launches the shell kit, runs a command,
and deletes the sandbox. Explain kits and image choices with examples,
along with compute sizes, quotas, permissions, resource lifecycle,
errors, and retries. Link subscription setup and billing to the shared
Docker Agentic Platform guide. Preserve the previous
`/ai/sandboxes/api/` URLs with redirects.
Uses the shared Docker Agentic Platform documentation merged in #26142.
Sibling to #26158, which introduces CLI-side Cloud Sandboxes
documentation.
Include 36 SDK cookbook recipes at `/ai/sandboxes-api/cookbook/` and the
public REST API reference at `/reference/api/sandboxes/`. Import the
generated export from `docker/sbx-api` commit `60d79c1d` (source
`1a7f4026`). Overview and installation remain maintained here. The
reference uses the shared API renderer from main, with separate
operation and schema pages, streaming and WebSocket details, and a
downloadable OpenAPI spec. An API reference link appears in the API/SDK
sidebar. A pinned manifest and import script provide the basis for later
release automation.
Examples are optional in the shared renderer; supplied examples still
have to pass schema validation. Requests without body examples use a
request-body file with instructions to prepare it. The import copies all
selected recipes and the OpenAPI specification byte for byte from the
corrected upstream export, without patches or link rewrites. The broken
naming recipe remains temporarily excluded.
This remains a draft pending validation against the published npm SDK.
The imported cookbook contains the TypeScript-only guidance, five-minute
request deadlines, kit-readiness explanation, active-policy status
requirement, and snapshot-deletion and lifetime-renewal restrictions.
Validation: scoped Markdown and Vale checks, full Hugo build, rendered
navigation, redirects, and internal links, and TypeScript type-checking
against the generated public SDK from `docker/sbx-api` commit
`68f214b9`. Import validation also covers all 60 REST operations and 188
schema definitions, 1,198 imported-page links and anchors,
desktop/mobile rendering, Markdown output, spec delivery, and a repeat
import. The shared renderer tests, strict generation for all five APIs
(zero diagnostics), full Hugo build, and verification of 453
HTML/Markdown page pairs and API links pass. No live sandbox execution.
The corrected export passes strict generation for all five APIs with
zero diagnostics, scoped Markdown/Vale lint, a full Hugo build, and
verification of 453 HTML/Markdown page pairs and API links. A repeat
import produces identical files. The spec update changes examples only;
schemas and operations are unchanged.
@netlify /ai/sandboxes-api/
Generated by Codex
---------
Co-authored-by: Claude <noreply@anthropic.com>
## Summary
Vendor the OpenAPI 3.2 specification merged in
docker/governor-services#755 and move AI Governance onto the unified API
reference renderer while preserving its existing URLs. This supersedes
#26067, which vendors an earlier upstream revision and retains the
legacy renderer.
@netlify /reference/api/ai-governance/latest/
[Deploy
preview](https://deploy-preview-26125--docsdocker.netlify.app/reference/api/ai-governance/latest/)
Generated by Codex
@netlify /reference/api/
[Preview the API
reference](https://deploy-preview-26048--docsdocker.netlify.app/reference/api/)
Adds a shared API reference experience for Hub, DVP, and Registry: a
catalog, operation navigation, linked schemas, request and response
examples, and matching HTML and Markdown output. A validation and
generation pipeline prepares the reference data for Hugo and runs as
part of Docker and Netlify builds.
Migrates the three specifications to OpenAPI 3.2, correcting response
shapes, nullable fields, and authentication and token examples. The Hub
migration also corrects SCIM contracts and CSV exports; DVP gains
complete report response schemas and examples. Registry keeps its
documented Hub-specific subset, with authentication and media
negotiation expressed through OpenAPI security and content fields.
Validation is strict for both checks and generation, with no exception
baseline or bypass flag. The build uses the migrated sources directly,
without migration scripts or records.
Page and specification URLs remain stable, including the DVP alias.
Operation and schema anchors change. Engine and Governance retain their
existing references.
Validated locally with Go tests, strict validation of all three
specifications (zero diagnostics), scoped formatting and lint, and a
full Hugo build checking all 176 HTML/Markdown page pairs, example
parity, reference links, and byte-identical published specifications. A
browser check confirmed raw CSV rendering and the generated request
header. No live API requests were made.
## Summary
Replace the static Featured topics section with a data-driven Whatʼs new
timeline. Show the five most important launches by default and let
readers expand the full curated 30-day archive.
Run a daily Claude Sonnet 5 curator over a rolling 30-day window, with
manual dispatch support, deterministic validation, and bot-managed pull
requests. Package the editorial workflow as the reusable
`curate-whats-new` repository skill so Docker Agent and other Agent
Skills-compatible clients can invoke the same process.
Preserve the human-reviewed July 13 through August 11, 2026 result and
flexible selection criteria as a regression example outside the skillʼs
runtime context.
@netlify /
[Homepage
preview](https://deploy-preview-25729--docsdocker.netlify.app/)
Generated by Codex
The second grep exits after finding the next release heading, which
can close the pipe while the first grep is still writing. With
pipefail, that SIGPIPE is reported as if the requested release notes
were missing.
Read the release file directly with awk and stop at the next level-two
heading so early termination cannot fail an upstream process.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
## Summary
The CloudFront redirect Lambda (`cloudfront-lambda-redirects.js`)
dropped the request query string when issuing 301 responses, so UTM tags
and other params were lost on redirected URLs. This appends the query
string to the `Location` header of both the exact-match and prefix
redirects (the directory/markdown rewrite branch already forwards the
request, so params survive there).
Adds unit tests (`node --test`, zero dependencies) that render the Go
template the same way `aws.go` does and exercise the handler. The tests
run in CI via a new `releaser-test` Dockerfile stage / bake target,
baked alongside `releaser-build` in the existing `releaser` job.
## Learnings
- The redirect Lambda source is a Go `text/template`
(`{{.RedirectsJSON}}` / `{{.RedirectsPrefixesJSON}}`), rendered and
zipped by `hack/releaser/aws.go`. To unit-test it, substitute the
placeholders the same way `aws.go` does, then evaluate the result as a
CommonJS module.
- `test-go-redirects` validates redirect *data* against the built
`public/` site, so it's the wrong host for a fast pure-JS test — the
`releaser` job, which already builds from `hack/releaser`, is the
natural home and has no Hugo dependency.
Generated by Claude Code
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add hack/sync-governance-api.sh to re-vendor the AI Governance Policy API
spec from the private docker/governor-services repo. The vendored copy at
content/reference/api/ai-governance/api.yaml is a verbatim copy of upstream,
so the script fetches it via gh (using the caller's own auth, no repo
secrets) and prints a diff summary for review. Mirrors the existing
hack/sync-cli-docs.sh convention.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Add content/manuals/ai/sandboxes/release-notes.md as a single page listing
the latest stable releases of Docker Sandboxes, with a link to the GitHub
release history for older versions.
The block between BEGIN/END GENERATED RELEASES markers is populated by
hack/sbx-release-notes.py — a single-file uv-run script (PEP 723 inline
deps, Jinja2 only) that hits the GitHub Releases API for
docker/sbx-releases, filters to strict-semver stable tags with non-empty
bodies, and emits H2-per-release sections for the latest N minor releases
(default 3) and their patches.
Re-runs are idempotent and only touch content between the markers. The
script also invokes `prettier --write` so the output stays lint-clean.
Extend the existing release-notes Vale skip rule with
content/manuals/**/release-notes.md so the new file under ai/sandboxes/
picks up the same lint exclusions as engine/desktop/build release notes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
The CloudFront Lambda rewrote `/` with `Accept: text/markdown` to an
invalid `.md` URI, causing a 502 LambdaValidationError. Homepage has no
flattened markdown equivalent, so route to `/llms.txt` — the
agent-oriented markdown index of the site. Same handling for
`/index.html`.
Also set `Content-Type: text/markdown` on `llms.txt` at upload time, so
content negotiation responses and direct requests both advertise the
correct media type.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Resolves internal links to point to the corresponding (rendered) path
rather than keeping them as internal links, which wouldn't make sense to
an agent/llm reading them.
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
This adds a GitHub Actions workflow and supporting script to
automatically sync CLI documentation from the docker/cli repository on a
daily schedule.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
This script helps maintain consistency between documentation and GitHub
release notes by making the docs the source of truth.
Previously, any djustments to release notes during review, needed to be
manually propagated back to the corresponding Moby GitHub releases,
creating a maintenance burden and potential for inconsistency.
The script extracts release notes for a given version from the engine
documentation markdown files, compares them with the existing GitHub
release notes, and provides a command to update the GitHub release if
differences are found.
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
Fix race condition issue to solve an issue about "panic: runtime error: invalid memory address or nil pointer dereference".
This fix stabilize Docker daemon under the situation of communication problem with Fluentd processes.
Signed-off-by: Satoshi Tagomori <tagomoris@gmail.com>
(cherry picked from commit 87124b9d62bc71f7632126cf7f8d5eb805c4a7f1)
Signed-off-by: Victor Vieux <vieux@docker.com>
Fixes#26394
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
(cherry picked from commit f528690674712b680caf2712092c7e2f8f236491)
Signed-off-by: Victor Vieux <vieux@docker.com>
Update apparmor error message
(cherry picked from commit e168f0b4ad4dfc11a4423a6785d80153f0969808)
Signed-off-by: Charles Smith <charles.smith@docker.com>
- Fixes a SNAT issue in loadbalancer when multiple networks are involved
- Fixes an issue with SRV query forwarding in DNS
- Fixes a map race
Signed-off-by: Jana Radhakrishnan <mrjana@docker.com>
(cherry picked from commit 56c98226955d98a2ba6a99bffd3a9a80d691e4a7)
Signed-off-by: Tibor Vass <tibor@docker.com>
