## Description Add an experimental Sandboxes API and SDK section alongside Docker Sandboxes under AI and agents, at `/ai/sandboxes-api/`. Cover installation of `@docker/sandboxes`, browser and PAT authentication, and a TypeScript walkthrough that launches the shell kit, runs a command, and deletes the sandbox. Explain kits and image choices with examples, along with compute sizes, quotas, permissions, resource lifecycle, errors, and retries. Link subscription setup and billing to the shared Docker Agentic Platform guide. Preserve the previous `/ai/sandboxes/api/` URLs with redirects. Uses the shared Docker Agentic Platform documentation merged in #26142. Sibling to #26158, which introduces CLI-side Cloud Sandboxes documentation. Include 36 SDK cookbook recipes at `/ai/sandboxes-api/cookbook/` and the public REST API reference at `/reference/api/sandboxes/`. Import the generated export from `docker/sbx-api` commit `60d79c1d` (source `1a7f4026`). Overview and installation remain maintained here. The reference uses the shared API renderer from main, with separate operation and schema pages, streaming and WebSocket details, and a downloadable OpenAPI spec. An API reference link appears in the API/SDK sidebar. A pinned manifest and import script provide the basis for later release automation. Examples are optional in the shared renderer; supplied examples still have to pass schema validation. Requests without body examples use a request-body file with instructions to prepare it. The import copies all selected recipes and the OpenAPI specification byte for byte from the corrected upstream export, without patches or link rewrites. The broken naming recipe remains temporarily excluded. This remains a draft pending validation against the published npm SDK. The imported cookbook contains the TypeScript-only guidance, five-minute request deadlines, kit-readiness explanation, active-policy status requirement, and snapshot-deletion and lifetime-renewal restrictions. Validation: scoped Markdown and Vale checks, full Hugo build, rendered navigation, redirects, and internal links, and TypeScript type-checking against the generated public SDK from `docker/sbx-api` commit `68f214b9`. Import validation also covers all 60 REST operations and 188 schema definitions, 1,198 imported-page links and anchors, desktop/mobile rendering, Markdown output, spec delivery, and a repeat import. The shared renderer tests, strict generation for all five APIs (zero diagnostics), full Hugo build, and verification of 453 HTML/Markdown page pairs and API links pass. No live sandbox execution. The corrected export passes strict generation for all five APIs with zero diagnostics, scoped Markdown/Vale lint, a full Hugo build, and verification of 453 HTML/Markdown page pairs and API links. A repeat import produces identical files. The spec update changes examples only; schemas and operations are unchanged. @netlify /ai/sandboxes-api/ Generated by Codex --------- Co-authored-by: Claude <noreply@anthropic.com>
API reference build
This tool validates the Hub, DVP, Registry, and AI Governance OpenAPI sources
in content/reference/api/ and generates presentation data for Hugo. Engine
retains its existing sources and renderer.
Commands
Use the Go version declared in go.mod, Hugo, and the site's Node dependencies.
From the repository root:
$ npm ci
$ ./hack/api-docs/run.sh test
$ ./hack/api-docs/run.sh generate
$ hugo server
For a static build with HTML/Markdown checks, run
./hack/api-docs/run.sh build. To serve that build on port 1314, run
./hack/api-docs/run.sh serve. Set DOCS_URL and DOCS_PORT when using another
address. Run generation again after changing a specification or source manifest entry.
With docker compose watch, changes to the registered specifications or
hack/api-docs/ rebuild the server image and regenerate the reference.
Docker builds and Netlify deploy previews run generation before Hugo. Generated
data, validation reports, binaries, and local builds go under tmp/api-reference/.
Hugo reports an error if the generated data is absent.
Processor inputs
sources.json registers input specifications and their product/manual
relationships. Both generation and the validation wrapper use this manifest.
Hugo reads the generated presentation data, rather than this file. Authentication
descriptions come from the specifications and linked guides.
validation/ contains the Vacuum rules and locked official
schema resources. testdata/ contains validation fixtures. The presentation model
version and supported dialect are defined by the processor, not configurable
manifest fields.
Pipeline
- Parse the authoritative YAML with
libopenapiand preserve source values and reference identities. Verify locked OpenAPI dialect resources. - Run Vacuum policy checks and JSON Schema validation of schemas and supplied examples, followed by documentation profile checks.
- Generate presentation model version 1: operations, effective security and servers, parameters, media variants, examples, schema links, and provenance.
- Render HTML and Markdown through the content adapter and
api-docstemplates. - Run the shared site flattening script, then check generated operation, parameter, media, schema, and link coverage.
The shared hack/flatten-and-resolve.js script resolves Markdown link destinations
relative to each original file, then moves index.md files to flattened paths.
It preserves code examples and other text. API pages use the same processing as
other pages; links that already use published URLs remain unchanged.
The published YAML URLs still serve the source files directly. There is no conversion step, snapshot dependency, Node migration package, or source archive in the build.
Validation
check is strict and reports every documentation profile failure:
$ ./hack/api-docs/run.sh check
Generation runs the same strict validation. Any diagnostic fails the build;
there is no exception baseline. Reports are written to
tmp/api-reference/validation.json.
Tests and scope
Go fixtures cover dialects, references, recursion, boolean schemas, examples,
security overrides, server and parameter precedence, and request generation.
verify-output.mjs checks all generated HTML/Markdown pairs, retention of
Engine v1.40–v1.56 in ReDoc, and byte-identical published specifications. It
also checks local links and fragments from API pages, including links to
docs.docker.com. The site htmltest checks include migrated Hub, DVP,
Registry, and AI Governance references. browser-checks.mjs exports a
Playwright check for navigation, page aliases, filtering, requests, and narrow
screens.
Callbacks and webhook navigation are unsupported and fail validation. Request examples are POSIX shell templates; they do not make service calls.
Examples are optional. Supplied examples must validate against their schemas.
When a request body has no example, the generated cURL command reads from
request-body and directs the reader to prepare that file from the schema.