From a992039a93640f0b64c1906d455ebba4b9f722b4 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Mon, 13 Jul 2026 10:04:06 +0200 Subject: [PATCH 1/3] sbx: describe sbx kit add as a sandbox restart, not a container recreation Reword the three kit-add descriptions in customize/kits.md to say sbx kit add restarts the sandbox to apply the kit, rather than recreating the sandbox "container". Sandboxes are described elsewhere in terms of the VM and stop/restart lifecycle, so "container" is off message and overemphasizes an implementation detail. VM-state preservation and immediate network-rule application are unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) --- content/manuals/ai/sandboxes/customize/kits.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/content/manuals/ai/sandboxes/customize/kits.md b/content/manuals/ai/sandboxes/customize/kits.md index 1b7f0942323..596ed605548 100644 --- a/content/manuals/ai/sandboxes/customize/kits.md +++ b/content/manuals/ai/sandboxes/customize/kits.md @@ -316,8 +316,9 @@ $ sbx run claude --kit /path/to/ruff-lint/ To apply the mixin to a sandbox that's already running, use [`sbx kit add`](#local) instead. The `--kit` flag only takes effect when a -sandbox is created. `sbx kit add` recreates the sandbox container, but VM state -— installed packages, Docker images, volumes, and agent history — is preserved. +sandbox is created. `sbx kit add` restarts the sandbox to apply the kit, but VM +state — installed packages, Docker images, volumes, and agent history — is +preserved. ## Sandbox kits @@ -389,9 +390,9 @@ several kits on the same sandbox. > against an existing sandbox name fails with > `--kit can only be used when creating a new sandbox`. To extend a > running sandbox with a kit, use [`sbx kit add`](#local) instead. -> `sbx kit add` recreates the sandbox container with the updated kit set. +> `sbx kit add` restarts the sandbox to apply the updated kit set. > VM state — installed packages, Docker images, volumes, and agent history -> — is preserved across the recreation. +> — is preserved across the restart. ### Local @@ -408,9 +409,9 @@ While iterating on a kit, apply changes to a running sandbox with `sbx kit add`: $ sbx kit add my-sandbox ./my-kit/ ``` -`sbx kit add` recreates the sandbox container with the updated kit set. +`sbx kit add` restarts the sandbox to apply the updated kit set. VM state — installed packages, Docker images, volumes, and agent history — is -preserved across the recreation. The kit's network allow/deny rules take effect +preserved across the restart. The kit's network allow/deny rules take effect immediately. Kits can't be removed from a running sandbox — remove and recreate it to start clean. From 4f351b14e1a16eee0e155f3824577519a639c552 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Tue, 14 Jul 2026 08:16:05 +0200 Subject: [PATCH 2/3] docs: remove deprecated docker sandbox (Docker Desktop plugin) The `docker sandbox` Docker Desktop plugin was fully removed in Docker Desktop 4.80.0. Remove the dedicated docs page, all CLI reference YAML files, and update the retired products page to reflect removal rather than deprecation. Update the AI overview table to reference `sbx`. Co-Authored-By: Claude Sonnet 4.6 --- content/manuals/ai-overview.md | 2 +- .../manuals/ai/sandboxes/docker-desktop.md | 238 ------------------ content/manuals/retired.md | 9 +- data/cli/sandbox/docker_sandbox.yaml | 64 ----- data/cli/sandbox/docker_sandbox_create.yaml | 148 ----------- .../sandbox/docker_sandbox_create_cagent.yaml | 66 ----- .../sandbox/docker_sandbox_create_claude.yaml | 77 ------ .../sandbox/docker_sandbox_create_codex.yaml | 66 ----- .../docker_sandbox_create_copilot.yaml | 47 ---- .../sandbox/docker_sandbox_create_gemini.yaml | 66 ----- .../sandbox/docker_sandbox_create_kiro.yaml | 66 ----- .../docker_sandbox_create_opencode.yaml | 66 ----- .../sandbox/docker_sandbox_create_shell.yaml | 47 ---- data/cli/sandbox/docker_sandbox_exec.yaml | 201 --------------- data/cli/sandbox/docker_sandbox_inspect.yaml | 65 ----- data/cli/sandbox/docker_sandbox_ls.yaml | 122 --------- data/cli/sandbox/docker_sandbox_network.yaml | 64 ----- .../sandbox/docker_sandbox_network_log.yaml | 132 ---------- .../sandbox/docker_sandbox_network_proxy.yaml | 208 --------------- data/cli/sandbox/docker_sandbox_reset.yaml | 92 ------- data/cli/sandbox/docker_sandbox_rm.yaml | 68 ----- data/cli/sandbox/docker_sandbox_run.yaml | 171 ------------- data/cli/sandbox/docker_sandbox_save.yaml | 64 ----- data/cli/sandbox/docker_sandbox_stop.yaml | 63 ----- data/cli/sandbox/docker_sandbox_version.yaml | 49 ---- 25 files changed, 4 insertions(+), 2257 deletions(-) delete mode 100644 content/manuals/ai/sandboxes/docker-desktop.md delete mode 100644 data/cli/sandbox/docker_sandbox.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_cagent.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_claude.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_codex.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_copilot.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_gemini.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_kiro.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_opencode.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_create_shell.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_exec.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_inspect.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_ls.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_network.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_network_log.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_network_proxy.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_reset.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_rm.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_run.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_save.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_stop.yaml delete mode 100644 data/cli/sandbox/docker_sandbox_version.yaml diff --git a/content/manuals/ai-overview.md b/content/manuals/ai-overview.md index 9597a324a68..d43e99ae296 100644 --- a/content/manuals/ai-overview.md +++ b/content/manuals/ai-overview.md @@ -20,7 +20,7 @@ Each tool serves a different purpose. | Run AI models locally with an OpenAI-compatible API | [Model Runner](./ai/model-runner/) | `docker model` | | Connect AI tools to external services via MCP | [MCP Catalog and Toolkit](./ai/mcp-catalog-and-toolkit/) | `docker mcp` | | Build and orchestrate custom multi-agent teams | [Docker Agent](./ai/docker-agent/) | `docker agent` | -| Run coding agents in isolated environments | [Docker Sandboxes](./ai/sandboxes/) | `docker sandbox` | +| Run coding agents in isolated environments | [Docker Sandboxes](./ai/sandboxes/) | `sbx` | ## How these tools relate diff --git a/content/manuals/ai/sandboxes/docker-desktop.md b/content/manuals/ai/sandboxes/docker-desktop.md deleted file mode 100644 index 57a07f97a74..00000000000 --- a/content/manuals/ai/sandboxes/docker-desktop.md +++ /dev/null @@ -1,238 +0,0 @@ ---- -title: Docker Desktop sandboxes (deprecated) -linkTitle: Docker Desktop -description: Run sandboxed AI coding agents using Docker Desktop and the docker sandbox CLI. -keywords: docker desktop, docker sandbox, ai agents, sandboxes, deprecated -weight: 80 -sitemap: false -notoc: true ---- - -> [!WARNING] -> -> The Docker Desktop-integrated `docker sandbox` commands are deprecated and -> replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). This -> deprecation applies only to the Docker Desktop integration, not to Docker -> Sandboxes. - -This page covers the Docker Desktop-integrated `docker sandbox` command for -running AI coding agents in isolated microVMs. This integration is superseded -by the standalone `sbx` CLI, which provides the full Docker Sandboxes workflow -and doesn't require Docker Desktop. - -> [!NOTE] -> Use the standalone `sbx` CLI for sandboxed AI agent workflows. - -## Prerequisites - -- Docker Desktop 4.58 or later -- macOS or Windows -- API keys for your chosen agent - -## Quick start - -1. Set your API key in your shell configuration file: - - ```plaintext {title="~/.bashrc or ~/.zshrc"} - export ANTHROPIC_API_KEY=sk-ant-api03-xxxxx - ``` - - Source your shell configuration and restart Docker Desktop so the daemon - picks up the variable. - -2. Create and run a sandbox: - - ```console - $ cd ~/my-project - $ docker sandbox run claude - ``` - - The first run takes longer while Docker initializes the microVM. - -Replace `claude` with a different [agent](#supported-agents) if needed. - -## Supported agents - -| Agent | Command | Notes | -| --------------------------------- | -------------- | ------------------------------------ | -| Claude Code | `claude` | Most tested implementation | -| Codex | `codex` | | -| Copilot | `copilot` | | -| Gemini | `gemini` | | -| [Docker Agent](/ai/docker-agent/) | `docker-agent` | Also available as a standalone tool | -| Kiro | `kiro` | | -| OpenCode | `opencode` | | -| Custom shell | `shell` | Minimal environment for manual setup | - -The agent type is specified when creating a sandbox and can't be changed later. - -## Authentication - -Each agent requires its own API key or credentials. Docker Sandboxes uses a -daemon that doesn't inherit environment variables from your shell session, so -you must set keys in your shell configuration file (not just export them in -your terminal). - -Common environment variables by agent: - -| Agent | Environment variable(s) | -| ------------ | ------------------------------------------------- | -| Claude Code | `ANTHROPIC_API_KEY` | -| Codex | `OPENAI_API_KEY` | -| Copilot | `GH_TOKEN` or `GITHUB_TOKEN` | -| Gemini | `GEMINI_API_KEY` or `GOOGLE_API_KEY` | -| Docker Agent | `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, and others | -| OpenCode | `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, and others | -| Kiro | Device flow (interactive browser login) | -| Shell | Any provider keys needed | - -After setting variables, source your shell configuration and restart Docker -Desktop. The sandbox proxy injects credentials into API requests so keys stay -on your host and are never stored inside the sandbox. - -## Commands - -```console -$ docker sandbox run AGENT [PATH] # Create and run -$ docker sandbox ls # List sandboxes -$ docker sandbox exec -it bash # Shell into a sandbox -$ docker sandbox rm # Remove a sandbox -$ docker sandbox reset # Remove all sandboxes -$ docker sandbox network proxy --policy … # Set network policy -$ docker sandbox network log # View network log -``` - -Sandboxes don't appear in `docker ps` because they're microVMs, not -containers. For the full command reference, see the -[CLI reference](/reference/cli/docker/sandbox/). - -Pass agent-specific CLI options after the sandbox name with a `--` separator: - -```console -$ docker sandbox run -- --continue -``` - -## Architecture - -Each sandbox is a lightweight microVM with its own kernel, using your system's -native virtualization (macOS virtualization.framework, Windows Hyper-V). The -default agent templates include a private Docker daemon, so `docker build` and -`docker compose up` run inside the sandbox without affecting your host. - -```plaintext -Host system - ├── Your containers and images - ├── Sandbox VM 1 - │ ├── Docker daemon (isolated) - │ ├── Agent container - │ └── Containers created by agent - └── Sandbox VM 2 - ├── Docker daemon (isolated) - └── Agent container -``` - -Your workspace syncs bidirectionally between host and sandbox at the same -absolute path. Outbound internet goes through an HTTP/HTTPS filtering proxy on -the host. See [Network policies](#network-policies) for configuration. - -## Network policies - -The filtering proxy controls what a sandbox can access. By default, all -traffic is allowed except private networks and localhost. - -Allow mode (block specific destinations): - -```console -$ docker sandbox network proxy my-sandbox \ - --policy allow \ - --block-cidr 10.0.0.0/8 -``` - -Deny mode (allow specific destinations): - -```console -$ docker sandbox network proxy my-sandbox \ - --policy deny \ - --allow-host api.anthropic.com \ - --allow-host "*.npmjs.org" -``` - -View what an agent is accessing: - -```console -$ docker sandbox network log -``` - -## Custom templates - -Build custom templates to pre-install tools: - -```dockerfile -FROM docker/sandbox-templates:claude-code - -USER root -RUN apt-get update && apt-get install -y build-essential \ - && rm -rf /var/lib/apt/lists/* -USER agent -``` - -```console -$ docker build -t my-template:v1 . -$ docker sandbox run -t my-template:v1 claude ~/project -``` - -## Base environment - -All agent templates share a common environment: - -- Ubuntu 25.10 -- Docker CLI (with Buildx and Compose), Git, GitHub CLI, Node.js, Go, Python 3, uv, make, jq, ripgrep -- Non-root `agent` user with sudo access -- Package managers: apt, pip, npm - -## Troubleshooting - - - -### 'sandbox' is not a docker command - - - -The CLI plugin isn't installed or isn't in the correct location. Verify the -plugin exists at `~/.docker/cli-plugins/docker-sandbox` and restart Docker -Desktop. - -### Beta features need to be enabled - -If your Docker Desktop is managed by an administrator with -[Settings Management](/enterprise/security/hardened-desktop/settings-management/), -ask them to -[allow beta features](/enterprise/security/hardened-desktop/settings-management/configure-json-file/#beta-features). - -### Authentication failure - -Verify your API key is valid and set in your shell configuration file (not -just exported in the current session). Source the file and restart Docker -Desktop. - -### Permission denied on workspace files - -Check **Docker Desktop** > **Settings** > **Resources** > **File Sharing** and -ensure your workspace path is listed. Verify file permissions with `ls -la`. - -### Sandbox crashes on Windows - -If launching multiple sandboxes causes crashes, end all `docker.openvmm.exe` -processes in Task Manager and restart Docker Desktop. Launch sandboxes one at a -time. - -### Persistent issues - -Reset all sandbox state: - -```console -$ docker sandbox reset -``` - -This stops all VMs and deletes all sandbox data. Create fresh sandboxes -afterward. diff --git a/content/manuals/retired.md b/content/manuals/retired.md index 5372bf0dc73..2b5401bfd6b 100644 --- a/content/manuals/retired.md +++ b/content/manuals/retired.md @@ -145,12 +145,9 @@ project requirements. ### Docker Desktop sandboxes Docker Desktop sandboxes let users run AI coding agents in isolated microVMs -through the `docker sandbox` command. The Docker Desktop integration is -deprecated. Use the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md) -instead. - -You can still view the -[Docker Desktop sandboxes documentation](/manuals/ai/sandboxes/docker-desktop.md). +through the `docker sandbox` command. The `docker sandbox` plugin was removed +in Docker Desktop 4.80.0. Use the standalone +[`sbx` CLI](/manuals/ai/sandboxes/_index.md) instead. ### Docker Scout features diff --git a/data/cli/sandbox/docker_sandbox.yaml b/data/cli/sandbox/docker_sandbox.yaml deleted file mode 100644 index 1b8a76efb53..00000000000 --- a/data/cli/sandbox/docker_sandbox.yaml +++ /dev/null @@ -1,64 +0,0 @@ -command: docker sandbox -short: Docker Sandbox -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Local sandbox environments for AI agents, using Docker. -usage: docker sandbox -pname: docker -plink: docker.yaml -cname: - - docker sandbox create - - docker sandbox exec - - docker sandbox ls - - docker sandbox network - - docker sandbox reset - - docker sandbox rm - - docker sandbox run - - docker sandbox save - - docker sandbox stop - - docker sandbox version -clink: - - docker_sandbox_create.yaml - - docker_sandbox_exec.yaml - - docker_sandbox_ls.yaml - - docker_sandbox_network.yaml - - docker_sandbox_reset.yaml - - docker_sandbox_rm.yaml - - docker_sandbox_run.yaml - - docker_sandbox_save.yaml - - docker_sandbox_stop.yaml - - docker_sandbox_version.yaml -options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create.yaml b/data/cli/sandbox/docker_sandbox_create.yaml deleted file mode 100644 index 28f02d39c93..00000000000 --- a/data/cli/sandbox/docker_sandbox_create.yaml +++ /dev/null @@ -1,148 +0,0 @@ -command: docker sandbox create -short: Create a sandbox for an agent -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for an agent. - - Available agents are provided as subcommands. Use "create AGENT --help" for agent-specific options. -usage: docker sandbox create [OPTIONS] AGENT WORKSPACE -pname: docker sandbox -plink: docker_sandbox.yaml -cname: - - docker sandbox create cagent - - docker sandbox create claude - - docker sandbox create codex - - docker sandbox create copilot - - docker sandbox create gemini - - docker sandbox create kiro - - docker sandbox create opencode - - docker sandbox create shell -clink: - - docker_sandbox_create_cagent.yaml - - docker_sandbox_create_claude.yaml - - docker_sandbox_create_codex.yaml - - docker_sandbox_create_copilot.yaml - - docker_sandbox_create_gemini.yaml - - docker_sandbox_create_kiro.yaml - - docker_sandbox_create_opencode.yaml - - docker_sandbox_create_shell.yaml -options: - - option: name - value_type: string - description: | - Name for the sandbox (default: -, letters, numbers, hyphens, underscores, periods, plus signs and minus signs only) - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: pull-template - value_type: string - default_value: missing - description: | - Template image pull policy: always (always pull from registry), missing (pull only if not cached), never (use only cached images) - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: quiet - shorthand: q - value_type: bool - default_value: "false" - description: Suppress verbose output - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: template - shorthand: t - value_type: string - description: | - Container image to use for the sandbox (default: agent-specific image) - details_url: '#template' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create a Claude sandbox - - ```console - $ docker sandbox create claude ~/my-project - ``` - - ### Create with a custom name - - ```console - $ docker sandbox create --name my-sandbox claude ~/my-project - ``` - - ### Use a custom base image (-t, --template) {#template} - - ```text - --template IMAGE - ``` - - Specify a custom container image to use as the sandbox base: - - ```console - $ docker sandbox create --template python:3-alpine claude ~/my-project - ``` - - By default, each agent uses a pre-configured image. - - ### Create and run immediately - - After creating a sandbox, use `run` to start the agent: - - ```console - $ docker sandbox create --name my-sandbox claude ~/my-project - $ docker sandbox run my-sandbox - ``` - - Or use `docker sandbox run` directly to create and run in one step: - - ```console - $ docker sandbox run claude ~/my-project - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_cagent.yaml b/data/cli/sandbox/docker_sandbox_create_cagent.yaml deleted file mode 100644 index 200fe86668a..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_cagent.yaml +++ /dev/null @@ -1,66 +0,0 @@ -command: docker sandbox create cagent -short: Create a sandbox for cagent -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for cagent. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start cagent after creation. -usage: docker sandbox create cagent WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create a Cagent sandbox in the current directory - - ```console - $ docker sandbox create cagent . - ``` - - ### Create with an absolute path - - ```console - $ docker sandbox create cagent /home/user/my-project - ``` - - ### Create and then run - - ```console - $ docker sandbox create --name my-cagent cagent ~/my-project - $ docker sandbox run my-cagent - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_claude.yaml b/data/cli/sandbox/docker_sandbox_create_claude.yaml deleted file mode 100644 index 7bef660a7a4..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_claude.yaml +++ /dev/null @@ -1,77 +0,0 @@ -command: docker sandbox create claude -short: Create a sandbox for claude -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for claude. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start claude after creation. -usage: docker sandbox create claude WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -options: - - option: patch-settings - value_type: bool - default_value: "false" - description: Intercept claude settings API call and patch payload - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create a Claude sandbox in the current directory - - ```console - $ docker sandbox create claude . - ``` - - ### Create with an absolute path - - ```console - $ docker sandbox create claude /home/user/my-project - ``` - - ### Create and then run - - ```console - $ docker sandbox create --name my-claude claude ~/my-project - $ docker sandbox run my-claude - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_codex.yaml b/data/cli/sandbox/docker_sandbox_create_codex.yaml deleted file mode 100644 index 0f415f8b7cb..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_codex.yaml +++ /dev/null @@ -1,66 +0,0 @@ -command: docker sandbox create codex -short: Create a sandbox for codex -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for codex. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start codex after creation. -usage: docker sandbox create codex WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create a Codex sandbox in the current directory - - ```console - $ docker sandbox create codex . - ``` - - ### Create with an absolute path - - ```console - $ docker sandbox create codex /home/user/my-project - ``` - - ### Create and then run - - ```console - $ docker sandbox create --name my-codex codex ~/my-project - $ docker sandbox run my-codex - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_copilot.yaml b/data/cli/sandbox/docker_sandbox_create_copilot.yaml deleted file mode 100644 index 06a6af12b28..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_copilot.yaml +++ /dev/null @@ -1,47 +0,0 @@ -command: docker sandbox create copilot -short: Create a sandbox for copilot -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for copilot. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start copilot after creation. -usage: docker sandbox create copilot WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_gemini.yaml b/data/cli/sandbox/docker_sandbox_create_gemini.yaml deleted file mode 100644 index 6d3a6231826..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_gemini.yaml +++ /dev/null @@ -1,66 +0,0 @@ -command: docker sandbox create gemini -short: Create a sandbox for gemini -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for gemini. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start gemini after creation. -usage: docker sandbox create gemini WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create a Gemini sandbox in the current directory - - ```console - $ docker sandbox create gemini . - ``` - - ### Create with an absolute path - - ```console - $ docker sandbox create gemini /home/user/my-project - ``` - - ### Create and then run - - ```console - $ docker sandbox create --name my-gemini gemini ~/my-project - $ docker sandbox run my-gemini - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_kiro.yaml b/data/cli/sandbox/docker_sandbox_create_kiro.yaml deleted file mode 100644 index 23ef3a2d081..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_kiro.yaml +++ /dev/null @@ -1,66 +0,0 @@ -command: docker sandbox create kiro -short: Create a sandbox for kiro -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for kiro. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start kiro after creation. -usage: docker sandbox create kiro WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create a Kiro sandbox in the current directory - - ```console - $ docker sandbox create kiro . - ``` - - ### Create with an absolute path - - ```console - $ docker sandbox create kiro /home/user/my-project - ``` - - ### Create and then run - - ```console - $ docker sandbox create --name my-kiro kiro ~/my-project - $ docker sandbox run my-kiro - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_opencode.yaml b/data/cli/sandbox/docker_sandbox_create_opencode.yaml deleted file mode 100644 index 132e0be55dd..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_opencode.yaml +++ /dev/null @@ -1,66 +0,0 @@ -command: docker sandbox create opencode -short: Create a sandbox for opencode -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for opencode. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start opencode after creation. -usage: docker sandbox create opencode WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create an OpenCode sandbox in the current directory - - ```console - $ docker sandbox create opencode . - ``` - - ### Create with an absolute path - - ```console - $ docker sandbox create opencode /home/user/my-project - ``` - - ### Create and then run - - ```console - $ docker sandbox create --name my-opencode opencode ~/my-project - $ docker sandbox run my-opencode - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_create_shell.yaml b/data/cli/sandbox/docker_sandbox_create_shell.yaml deleted file mode 100644 index f97e87bb06c..00000000000 --- a/data/cli/sandbox/docker_sandbox_create_shell.yaml +++ /dev/null @@ -1,47 +0,0 @@ -command: docker sandbox create shell -short: Create a sandbox for shell -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Create a sandbox with access to a host workspace for shell. - - The workspace path is required and will be exposed inside the sandbox at the same path as on the host. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Use 'docker sandbox run SANDBOX' to start shell after creation. -usage: docker sandbox create shell WORKSPACE [EXTRA_WORKSPACE...] -pname: docker sandbox create -plink: docker_sandbox_create.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_exec.yaml b/data/cli/sandbox/docker_sandbox_exec.yaml deleted file mode 100644 index 6e0643d473c..00000000000 --- a/data/cli/sandbox/docker_sandbox_exec.yaml +++ /dev/null @@ -1,201 +0,0 @@ -command: docker sandbox exec -short: Execute a command inside a sandbox -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Execute a command in a sandbox that was previously created with 'docker sandbox create'. - - The command and any additional arguments are executed inside the sandbox container. -usage: docker sandbox exec [OPTIONS] SANDBOX COMMAND [ARG...] -pname: docker sandbox -plink: docker_sandbox.yaml -options: - - option: detach - shorthand: d - value_type: bool - default_value: "false" - description: 'Detached mode: run command in the background' - details_url: '#detach' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: detach-keys - value_type: string - description: Override the key sequence for detaching a container - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: env - shorthand: e - value_type: stringArray - default_value: '[]' - description: Set environment variables - details_url: '#env' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: env-file - value_type: stringArray - default_value: '[]' - description: Read in a file of environment variables - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: interactive - shorthand: i - value_type: bool - default_value: "false" - description: Keep STDIN open even if not attached - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: privileged - value_type: bool - default_value: "false" - description: Give extended privileges to the command - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: tty - shorthand: t - value_type: bool - default_value: "false" - description: Allocate a pseudo-TTY - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: user - shorthand: u - value_type: string - description: 'Username or UID (format: [:])' - details_url: '#user' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: workdir - shorthand: w - value_type: string - description: Working directory inside the container - details_url: '#workdir' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Execute a command in a sandbox - - ```console - $ docker sandbox exec my-sandbox ls -la - ``` - - ### Run an interactive shell - - ```console - $ docker sandbox exec -it my-sandbox /bin/bash - ``` - - ### Set environment variables (-e, --env) {#env} - - ```text - --env KEY=VALUE - ``` - - Pass environment variables to the command: - - ```console - $ docker sandbox exec \ - --env NODE_ENV=development \ - --env DATABASE_URL=postgresql://localhost/myapp \ - my-sandbox npm test - ``` - - ### Set working directory (-w, --workdir) {#workdir} - - ```text - --workdir PATH - ``` - - Run the command in a specific directory: - - ```console - $ docker sandbox exec --workdir /app my-sandbox python script.py - ``` - - ### Run as specific user (-u, --user) {#user} - - ```text - --user USER[:GROUP] - ``` - - Execute command as a different user: - - ```console - $ docker sandbox exec --user 1000:1000 my-sandbox id - ``` - - ### Run in background (-d, --detach) {#detach} - - Run a long-running command in the background: - - ```console - $ docker sandbox exec -d my-sandbox python server.py - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_inspect.yaml b/data/cli/sandbox/docker_sandbox_inspect.yaml deleted file mode 100644 index 94b47738b6f..00000000000 --- a/data/cli/sandbox/docker_sandbox_inspect.yaml +++ /dev/null @@ -1,65 +0,0 @@ -command: docker sandbox inspect -short: Display detailed information on one or more sandboxes -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Display detailed information on one or more sandboxes. - - This command retrieves and displays detailed information about the specified - sandboxes using the Docker API. Each sandbox is identified by its unique ID or name. -usage: docker sandbox inspect [OPTIONS] SANDBOX [SANDBOX...] -pname: docker sandbox -plink: docker_sandbox.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Inspect a sandbox - - ```console - $ docker sandbox inspect abc123def - [ - { - "id": "abc123def69b16c5c0dab4cf699e26f8d01e1ace3aeee06254e0999492e11647", - "name": "claude-sandbox-2025-11-04-170333", - "created_at": "2025-11-04T16:03:33.910642347Z", - "status": "running", - "template": "docker/sandbox-templates:claude-code", - "labels": { - "com.docker.sandbox.agent": "claude", - "com.docker.sandbox.workingDirectory": "/Users/moby/code/docker/sandboxes", - "com.docker.sandbox.workingDirectoryInode": "3041007", - "com.docker.sandboxes": "templates", - "com.docker.sandboxes.base": "ubuntu:questing", - "com.docker.sandboxes.flavor": "claude-code", - "com.docker.sdk": "true", - "com.docker.sdk.client": "0.1.0-alpha011", - "com.docker.sdk.container": "0.1.0-alpha012", - "com.docker.sdk.lang": "go", - "docker/sandbox": "true", - "org.opencontainers.image.ref.name": "ubuntu", - "org.opencontainers.image.version": "25.10" - } - } - ] - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_ls.yaml b/data/cli/sandbox/docker_sandbox_ls.yaml deleted file mode 100644 index 9eccb54007b..00000000000 --- a/data/cli/sandbox/docker_sandbox_ls.yaml +++ /dev/null @@ -1,122 +0,0 @@ -command: docker sandbox ls -aliases: docker sandbox ls, docker sandbox list -short: List VMs -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - List all VMs managed by sandboxd with their sandboxes -usage: docker sandbox ls [OPTIONS] -pname: docker sandbox -plink: docker_sandbox.yaml -options: - - option: json - value_type: bool - default_value: "false" - description: Output in JSON format - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: quiet - shorthand: q - value_type: bool - default_value: "false" - description: Only display VM names - details_url: '#quiet' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### List all VMs - - ```console - $ docker sandbox ls - VM ID NAME STATUS WORKSPACE SOCKET PATH SANDBOXES AGENTS - abc123def claude-vm running /home/user/my-project /Users/.../docker-1764682554072.sock 2 claude - def456ghi gemini-vm stopped /home/user/ml-projects - ``` - - ### Show only VM names (--quiet) {#quiet} - - ```text - --quiet - ``` - - Output only VM names: - - ```console - $ docker sandbox ls --quiet - claude-vm - gemini-vm - ``` - - ### JSON output (--json) - - ```text - --json - ``` - - Output detailed VM information in JSON format: - - ```console - $ docker sandbox ls --json - { - "vms": [ - { - "name": "claude-vm", - "agent": "claude", - "status": "running", - "socket_path": "/Users/user/.docker/sandboxes/vm/claude-vm/docker-1234567890.sock", - "sandbox_count": 2, - "workspaces": [ - "/home/user/my-project", - "/home/user/another-project" - ] - }, - { - "name": "gemini-vm", - "agent": "gemini", - "status": "stopped", - "sandbox_count": 0 - } - ] - } - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_network.yaml b/data/cli/sandbox/docker_sandbox_network.yaml deleted file mode 100644 index 8b91cb27a5d..00000000000 --- a/data/cli/sandbox/docker_sandbox_network.yaml +++ /dev/null @@ -1,64 +0,0 @@ -command: docker sandbox network -short: Manage sandbox networking -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Manage sandbox networking -usage: docker sandbox network -pname: docker sandbox -plink: docker_sandbox.yaml -cname: - - docker sandbox network log - - docker sandbox network proxy -clink: - - docker_sandbox_network_log.yaml - - docker_sandbox_network_proxy.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### View network logs - - ```console - $ docker sandbox network log - ``` - - ### Configure proxy for a sandbox - - ```console - $ docker sandbox network proxy my-sandbox --block-host example.com - ``` - - See the subcommands for more details: - - [`docker sandbox network log`](/reference/cli/docker/sandbox/network/log/) - Show network logs - - [`docker sandbox network proxy`](/reference/cli/docker/sandbox/network/proxy/) - Manage proxy configuration -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_network_log.yaml b/data/cli/sandbox/docker_sandbox_network_log.yaml deleted file mode 100644 index a336553cab3..00000000000 --- a/data/cli/sandbox/docker_sandbox_network_log.yaml +++ /dev/null @@ -1,132 +0,0 @@ -command: docker sandbox network log -short: Show network logs -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Show network logs -usage: docker sandbox network log -pname: docker sandbox network -plink: docker_sandbox_network.yaml -options: - - option: json - value_type: bool - default_value: "false" - description: Output in JSON format - details_url: '#json' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: limit - value_type: int - default_value: "0" - description: Maximum number of log entries to show - details_url: '#limit' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: quiet - shorthand: q - value_type: bool - default_value: "false" - description: Only display log entries - details_url: '#quiet' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Show network logs - - ```console - $ docker sandbox network log - 2026-01-29T10:15:23Z sandbox=my-sandbox request GET https://api.example.com/data allowed - 2026-01-29T10:15:24Z sandbox=my-sandbox request POST https://api.example.com/submit allowed - 2026-01-29T10:15:25Z sandbox=my-sandbox request GET https://blocked.example.com/ denied - ``` - - ### Show only log entries (--quiet) {#quiet} - - ```text - --quiet - ``` - - Suppress headers and only show log entries: - - ```console - $ docker sandbox network log --quiet - 2026-01-29T10:15:23Z sandbox=my-sandbox request GET https://api.example.com/data allowed - 2026-01-29T10:15:24Z sandbox=my-sandbox request POST https://api.example.com/submit allowed - ``` - - ### Limit number of entries (--limit) {#limit} - - ```text - --limit N - ``` - - Show only the last N log entries: - - ```console - $ docker sandbox network log --limit 10 - ``` - - ### JSON output (--json) {#json} - - Output logs in JSON format for parsing: - - ```console - $ docker sandbox network log --json - { - "entries": [ - { - "timestamp": "2026-01-29T10:15:23Z", - "sandbox": "my-sandbox", - "type": "request", - "method": "GET", - "url": "https://api.example.com/data", - "action": "allowed" - } - ] - } - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_network_proxy.yaml b/data/cli/sandbox/docker_sandbox_network_proxy.yaml deleted file mode 100644 index 4d08f755714..00000000000 --- a/data/cli/sandbox/docker_sandbox_network_proxy.yaml +++ /dev/null @@ -1,208 +0,0 @@ -command: docker sandbox network proxy -short: Manage proxy configuration for a sandbox -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Manage proxy configuration for a sandbox -usage: docker sandbox network proxy [OPTIONS] -pname: docker sandbox network -plink: docker_sandbox_network.yaml -options: - - option: allow-cidr - value_type: string - description: | - Remove an IP range in CIDR notation from the block or bypass lists (can be specified multiple times) - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: allow-host - value_type: string - description: Permit access to a domain or IP (can be specified multiple times) - details_url: '#allow-host' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: block-cidr - value_type: string - description: | - Block access to an IP range in CIDR notation (can be specified multiple times) - details_url: '#block-cidr' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: block-host - value_type: string - description: Block access to a domain or IP (can be specified multiple times) - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: bypass-cidr - value_type: string - description: | - Bypass MITM proxy for an IP range in CIDR notation (can be specified multiple times) - details_url: '#bypass-cidr' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: bypass-host - value_type: string - description: | - Bypass MITM proxy for a domain or IP (can be specified multiple times) - details_url: '#bypass-host' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: policy - value_type: allow|deny - description: Set the default policy - details_url: '#policy' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Block access to a domain - - ```console - $ docker sandbox network proxy my-sandbox --block-host example.com - ``` - - ### Block multiple domains - - ```console - $ docker sandbox network proxy my-sandbox \ - --block-host example.com \ - --block-host malicious.site - ``` - - ### Block IP range (--block-cidr) {#block-cidr} - - ```text - --block-cidr CIDR - ``` - - Block access to an IP range in CIDR notation: - - ```console - $ docker sandbox network proxy my-sandbox --block-cidr 192.168.1.0/24 - ``` - - ### Allow specific domain (--allow-host) {#allow-host} - - ```text - --allow-host DOMAIN - ``` - - Permit access to a domain (useful with deny-by-default policy): - - ```console - $ docker sandbox network proxy my-sandbox \ - --policy deny \ - --allow-host api.trusted-service.com - ``` - - ### Bypass MITM proxy for domain (--bypass-host) {#bypass-host} - - ```text - --bypass-host DOMAIN - ``` - - Bypass MITM proxy for specific domains: - - ```console - $ docker sandbox network proxy my-sandbox --bypass-host localhost - ``` - - ### Bypass MITM proxy for IP range (--bypass-cidr) {#bypass-cidr} - - ```text - --bypass-cidr CIDR - ``` - - Bypass MITM proxy for an IP range: - - ```console - $ docker sandbox network proxy my-sandbox --bypass-cidr 127.0.0.0/8 - ``` - - ### Set default policy (--policy) {#policy} - - ```text - --policy allow|deny - ``` - - Set the default policy for network access: - - ```console - # Allow by default, block specific hosts - $ docker sandbox network proxy my-sandbox \ - --policy allow \ - --block-host dangerous.example - - # Deny by default, allow specific hosts - $ docker sandbox network proxy my-sandbox \ - --policy deny \ - --allow-host api.trusted.com \ - --allow-host cdn.trusted.com - ``` - - ### Remove rules - - Use `--allow-cidr` to remove IP ranges from block or bypass lists: - - ```console - $ docker sandbox network proxy my-sandbox --allow-cidr 192.168.1.0/24 - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_reset.yaml b/data/cli/sandbox/docker_sandbox_reset.yaml deleted file mode 100644 index af156092fb8..00000000000 --- a/data/cli/sandbox/docker_sandbox_reset.yaml +++ /dev/null @@ -1,92 +0,0 @@ -command: docker sandbox reset -short: Reset all VM sandboxes and clean up state -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Reset all VM sandboxes and permanently delete all VM data. - - This command will: - - Stop all running VMs gracefully (30s timeout) - - Delete all VM state directories in ~/.docker/sandboxes/vm/ - - Clear image cache in ~/.docker/sandboxes/image-cache/ - - Clear all internal registries - - The daemon will continue running with fresh state after reset. - - ⚠️ WARNING: This is a destructive operation that cannot be undone! - All running agents will be forcefully terminated and their work will be lost. - Cached image tars will be deleted and will need to be recreated on next use. - - By default, you will be prompted to confirm (y/N). - Use --force to skip the confirmation prompt. -usage: docker sandbox reset [OPTIONS] -pname: docker sandbox -plink: docker_sandbox.yaml -options: - - option: force - shorthand: f - value_type: bool - default_value: "false" - description: Skip confirmation prompt - details_url: '#force' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Reset with confirmation prompt - - ```console - $ docker sandbox reset - ⚠️ WARNING: This will permanently delete all VM data and stop all running agents! - Are you sure you want to continue? (y/N): y - All VMs reset successfully - ``` - - ### Force reset without confirmation (-f, --force) {#force} - - Skip the confirmation prompt: - - ```console - $ docker sandbox reset --force - All VMs reset successfully - ``` - - > [!CAUTION] - > This is a destructive operation that cannot be undone! - > All running agents will be terminated and their work will be lost. -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_rm.yaml b/data/cli/sandbox/docker_sandbox_rm.yaml deleted file mode 100644 index dce4b78a0b8..00000000000 --- a/data/cli/sandbox/docker_sandbox_rm.yaml +++ /dev/null @@ -1,68 +0,0 @@ -command: docker sandbox rm -aliases: docker sandbox rm, docker sandbox remove -short: Remove one or more sandboxes -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Remove one or more sandboxes and all their associated resources. - - This command will: - - Check if the sandbox exists - - Remove the sandbox and clean up its associated resources -usage: docker sandbox rm SANDBOX [SANDBOX...] -pname: docker sandbox -plink: docker_sandbox.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Remove a sandbox - - ```console - $ docker sandbox rm abc123def - abc123def - ``` - - ### Remove multiple sandboxes - - ```console - $ docker sandbox rm abc123def def456ghi - abc123def - def456ghi - ``` - - ### Remove all sandboxes - - ```console - $ docker sandbox rm $(docker sandbox ls -q) - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_run.yaml b/data/cli/sandbox/docker_sandbox_run.yaml deleted file mode 100644 index 75d93705617..00000000000 --- a/data/cli/sandbox/docker_sandbox_run.yaml +++ /dev/null @@ -1,171 +0,0 @@ -command: docker sandbox run -short: Run an agent in a sandbox -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Run an agent in a sandbox. Create the sandbox if it does not exist. - - Pass agent arguments after the "--" separator. - Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. - - Examples: - # Create and run a sandbox with claude in current directory - docker sandbox run claude - - # Create and run a sandbox with claude in current directory (explicit) - docker sandbox run claude . - - # Create and run with additional workspaces (read-only) - docker sandbox run claude . /path/to/docs:ro - - # Run an existing sandbox - docker sandbox run existing-sandbox - - # Run a sandbox with agent arguments - docker sandbox run claude -- --continue -usage: docker sandbox run SANDBOX [-- AGENT_ARGS...] | AGENT [WORKSPACE] [EXTRA_WORKSPACE...] [-- AGENT_ARGS...] -pname: docker sandbox -plink: docker_sandbox.yaml -options: - - option: detached - shorthand: d - value_type: bool - default_value: "false" - description: Return sandbox ID without running agent (hidden, for testing) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: name - value_type: string - description: 'Name for the sandbox (default: -)' - details_url: '#name' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: patch-settings - value_type: bool - default_value: "false" - description: Intercept claude settings API call and patch payload - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: pull-template - value_type: string - default_value: missing - description: | - Template image pull policy: always (always pull from registry), missing (pull only if not cached), never (use only cached images) - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: template - shorthand: t - value_type: string - description: | - Container image to use for the sandbox (default: agent-specific image) - details_url: '#template' - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Create and run Claude in the current directory - - ```console - $ docker sandbox run claude . - ``` - - ### Run an existing sandbox - - ```console - $ docker sandbox run my-sandbox - ``` - - ### Create and run with a specific workspace - - ```console - $ docker sandbox run claude ~/projects/my-app - ``` - - The workspace directory is mounted at the same absolute path inside the sandbox. - - ### Name the sandbox (--name) {#name} - - ```text - --name NAME - ``` - - Assign a custom name when creating a sandbox: - - ```console - $ docker sandbox run --name my-project claude . - ``` - - ### Use a custom base image (-t, --template) {#template} - - ```text - --template IMAGE - ``` - - Specify a custom container image when creating a sandbox: - - ```console - $ docker sandbox run --template python:3-alpine claude . - ``` - - By default, each agent uses a pre-configured image. The `--template` option - lets you substitute a different image. - - ### Pass arguments to the agent - - Use `--` to separate sandbox options from agent arguments: - - ```console - $ docker sandbox run claude . -- -p "What version are you running?" - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_save.yaml b/data/cli/sandbox/docker_sandbox_save.yaml deleted file mode 100644 index a326ad69ba6..00000000000 --- a/data/cli/sandbox/docker_sandbox_save.yaml +++ /dev/null @@ -1,64 +0,0 @@ -command: docker sandbox save -short: Save a snapshot of the sandbox as a template -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Save a snapshot of the sandbox as a template. - - By default, the image is loaded into the host's Docker daemon (requires Docker to be running). - Use --output to save the image to a tar file instead. - - Examples: - # Load into host Docker (requires host Docker running) - docker sandbox save my-sandbox myimage:v1.0 - - # Save to file (works without host Docker) - docker sandbox save my-sandbox myimage:v1.0 --output /tmp/myimage.tar -usage: docker sandbox save SANDBOX TAG -pname: docker sandbox -plink: docker_sandbox.yaml -options: - - option: output - shorthand: o - value_type: string - description: | - Save image to specified tar file instead of loading into host Docker - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_stop.yaml b/data/cli/sandbox/docker_sandbox_stop.yaml deleted file mode 100644 index 957b1ee275c..00000000000 --- a/data/cli/sandbox/docker_sandbox_stop.yaml +++ /dev/null @@ -1,63 +0,0 @@ -command: docker sandbox stop -short: Stop one or more sandboxes without removing them -long: | - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Stop one or more sandboxes without removing them. The sandboxes can be restarted later. -usage: docker sandbox stop SANDBOX [SANDBOX...] -pname: docker sandbox -plink: docker_sandbox.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Stop a sandbox - - ```console - $ docker sandbox stop my-sandbox - my-sandbox - ``` - - ### Stop multiple sandboxes - - ```console - $ docker sandbox stop sandbox1 sandbox2 - sandbox1 - sandbox2 - ``` - - ### Stop all running sandboxes - - ```console - $ docker sandbox stop $(docker sandbox ls -q) - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - diff --git a/data/cli/sandbox/docker_sandbox_version.yaml b/data/cli/sandbox/docker_sandbox_version.yaml deleted file mode 100644 index e7c0e3a9076..00000000000 --- a/data/cli/sandbox/docker_sandbox_version.yaml +++ /dev/null @@ -1,49 +0,0 @@ -command: docker sandbox version -short: Show sandbox version information -long: |- - > [!WARNING] - > The Docker Desktop-integrated `docker sandbox` commands are deprecated and - > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). - > This deprecation applies only to the Docker Desktop integration, not to Docker - > Sandboxes. - - Show sandbox version information -usage: docker sandbox version -pname: docker sandbox -plink: docker_sandbox.yaml -inherited_options: - - option: debug - shorthand: D - value_type: bool - default_value: "false" - description: Enable debug logging - deprecated: false - hidden: false - experimental: false - experimentalcli: false - kubernetes: false - swarm: false - - option: socket - value_type: string - description: | - Connect to daemon at specific socket path (for development/debugging) - deprecated: false - hidden: true - experimental: false - experimentalcli: false - kubernetes: false - swarm: false -examples: |- - ### Show version information - - ```console - $ docker sandbox version - github.com/docker/sandboxes/cli-plugin v0.7.1 f00f0d6473647c2201cd0507ce31613345c48ae6 - ``` -deprecated: false -hidden: false -experimental: false -experimentalcli: false -kubernetes: false -swarm: false - From 52690d5fdaaa5c82e55c689b6439dba42bf5f125 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Tue, 14 Jul 2026 08:16:45 +0200 Subject: [PATCH 3/3] Revert "docs: remove deprecated docker sandbox (Docker Desktop plugin)" This reverts commit 4f351b14e1a16eee0e155f3824577519a639c552. --- content/manuals/ai-overview.md | 2 +- .../manuals/ai/sandboxes/docker-desktop.md | 238 ++++++++++++++++++ content/manuals/retired.md | 9 +- data/cli/sandbox/docker_sandbox.yaml | 64 +++++ data/cli/sandbox/docker_sandbox_create.yaml | 148 +++++++++++ .../sandbox/docker_sandbox_create_cagent.yaml | 66 +++++ .../sandbox/docker_sandbox_create_claude.yaml | 77 ++++++ .../sandbox/docker_sandbox_create_codex.yaml | 66 +++++ .../docker_sandbox_create_copilot.yaml | 47 ++++ .../sandbox/docker_sandbox_create_gemini.yaml | 66 +++++ .../sandbox/docker_sandbox_create_kiro.yaml | 66 +++++ .../docker_sandbox_create_opencode.yaml | 66 +++++ .../sandbox/docker_sandbox_create_shell.yaml | 47 ++++ data/cli/sandbox/docker_sandbox_exec.yaml | 201 +++++++++++++++ data/cli/sandbox/docker_sandbox_inspect.yaml | 65 +++++ data/cli/sandbox/docker_sandbox_ls.yaml | 122 +++++++++ data/cli/sandbox/docker_sandbox_network.yaml | 64 +++++ .../sandbox/docker_sandbox_network_log.yaml | 132 ++++++++++ .../sandbox/docker_sandbox_network_proxy.yaml | 208 +++++++++++++++ data/cli/sandbox/docker_sandbox_reset.yaml | 92 +++++++ data/cli/sandbox/docker_sandbox_rm.yaml | 68 +++++ data/cli/sandbox/docker_sandbox_run.yaml | 171 +++++++++++++ data/cli/sandbox/docker_sandbox_save.yaml | 64 +++++ data/cli/sandbox/docker_sandbox_stop.yaml | 63 +++++ data/cli/sandbox/docker_sandbox_version.yaml | 49 ++++ 25 files changed, 2257 insertions(+), 4 deletions(-) create mode 100644 content/manuals/ai/sandboxes/docker-desktop.md create mode 100644 data/cli/sandbox/docker_sandbox.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_cagent.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_claude.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_codex.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_copilot.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_gemini.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_kiro.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_opencode.yaml create mode 100644 data/cli/sandbox/docker_sandbox_create_shell.yaml create mode 100644 data/cli/sandbox/docker_sandbox_exec.yaml create mode 100644 data/cli/sandbox/docker_sandbox_inspect.yaml create mode 100644 data/cli/sandbox/docker_sandbox_ls.yaml create mode 100644 data/cli/sandbox/docker_sandbox_network.yaml create mode 100644 data/cli/sandbox/docker_sandbox_network_log.yaml create mode 100644 data/cli/sandbox/docker_sandbox_network_proxy.yaml create mode 100644 data/cli/sandbox/docker_sandbox_reset.yaml create mode 100644 data/cli/sandbox/docker_sandbox_rm.yaml create mode 100644 data/cli/sandbox/docker_sandbox_run.yaml create mode 100644 data/cli/sandbox/docker_sandbox_save.yaml create mode 100644 data/cli/sandbox/docker_sandbox_stop.yaml create mode 100644 data/cli/sandbox/docker_sandbox_version.yaml diff --git a/content/manuals/ai-overview.md b/content/manuals/ai-overview.md index d43e99ae296..9597a324a68 100644 --- a/content/manuals/ai-overview.md +++ b/content/manuals/ai-overview.md @@ -20,7 +20,7 @@ Each tool serves a different purpose. | Run AI models locally with an OpenAI-compatible API | [Model Runner](./ai/model-runner/) | `docker model` | | Connect AI tools to external services via MCP | [MCP Catalog and Toolkit](./ai/mcp-catalog-and-toolkit/) | `docker mcp` | | Build and orchestrate custom multi-agent teams | [Docker Agent](./ai/docker-agent/) | `docker agent` | -| Run coding agents in isolated environments | [Docker Sandboxes](./ai/sandboxes/) | `sbx` | +| Run coding agents in isolated environments | [Docker Sandboxes](./ai/sandboxes/) | `docker sandbox` | ## How these tools relate diff --git a/content/manuals/ai/sandboxes/docker-desktop.md b/content/manuals/ai/sandboxes/docker-desktop.md new file mode 100644 index 00000000000..57a07f97a74 --- /dev/null +++ b/content/manuals/ai/sandboxes/docker-desktop.md @@ -0,0 +1,238 @@ +--- +title: Docker Desktop sandboxes (deprecated) +linkTitle: Docker Desktop +description: Run sandboxed AI coding agents using Docker Desktop and the docker sandbox CLI. +keywords: docker desktop, docker sandbox, ai agents, sandboxes, deprecated +weight: 80 +sitemap: false +notoc: true +--- + +> [!WARNING] +> +> The Docker Desktop-integrated `docker sandbox` commands are deprecated and +> replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). This +> deprecation applies only to the Docker Desktop integration, not to Docker +> Sandboxes. + +This page covers the Docker Desktop-integrated `docker sandbox` command for +running AI coding agents in isolated microVMs. This integration is superseded +by the standalone `sbx` CLI, which provides the full Docker Sandboxes workflow +and doesn't require Docker Desktop. + +> [!NOTE] +> Use the standalone `sbx` CLI for sandboxed AI agent workflows. + +## Prerequisites + +- Docker Desktop 4.58 or later +- macOS or Windows +- API keys for your chosen agent + +## Quick start + +1. Set your API key in your shell configuration file: + + ```plaintext {title="~/.bashrc or ~/.zshrc"} + export ANTHROPIC_API_KEY=sk-ant-api03-xxxxx + ``` + + Source your shell configuration and restart Docker Desktop so the daemon + picks up the variable. + +2. Create and run a sandbox: + + ```console + $ cd ~/my-project + $ docker sandbox run claude + ``` + + The first run takes longer while Docker initializes the microVM. + +Replace `claude` with a different [agent](#supported-agents) if needed. + +## Supported agents + +| Agent | Command | Notes | +| --------------------------------- | -------------- | ------------------------------------ | +| Claude Code | `claude` | Most tested implementation | +| Codex | `codex` | | +| Copilot | `copilot` | | +| Gemini | `gemini` | | +| [Docker Agent](/ai/docker-agent/) | `docker-agent` | Also available as a standalone tool | +| Kiro | `kiro` | | +| OpenCode | `opencode` | | +| Custom shell | `shell` | Minimal environment for manual setup | + +The agent type is specified when creating a sandbox and can't be changed later. + +## Authentication + +Each agent requires its own API key or credentials. Docker Sandboxes uses a +daemon that doesn't inherit environment variables from your shell session, so +you must set keys in your shell configuration file (not just export them in +your terminal). + +Common environment variables by agent: + +| Agent | Environment variable(s) | +| ------------ | ------------------------------------------------- | +| Claude Code | `ANTHROPIC_API_KEY` | +| Codex | `OPENAI_API_KEY` | +| Copilot | `GH_TOKEN` or `GITHUB_TOKEN` | +| Gemini | `GEMINI_API_KEY` or `GOOGLE_API_KEY` | +| Docker Agent | `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, and others | +| OpenCode | `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, and others | +| Kiro | Device flow (interactive browser login) | +| Shell | Any provider keys needed | + +After setting variables, source your shell configuration and restart Docker +Desktop. The sandbox proxy injects credentials into API requests so keys stay +on your host and are never stored inside the sandbox. + +## Commands + +```console +$ docker sandbox run AGENT [PATH] # Create and run +$ docker sandbox ls # List sandboxes +$ docker sandbox exec -it bash # Shell into a sandbox +$ docker sandbox rm # Remove a sandbox +$ docker sandbox reset # Remove all sandboxes +$ docker sandbox network proxy --policy … # Set network policy +$ docker sandbox network log # View network log +``` + +Sandboxes don't appear in `docker ps` because they're microVMs, not +containers. For the full command reference, see the +[CLI reference](/reference/cli/docker/sandbox/). + +Pass agent-specific CLI options after the sandbox name with a `--` separator: + +```console +$ docker sandbox run -- --continue +``` + +## Architecture + +Each sandbox is a lightweight microVM with its own kernel, using your system's +native virtualization (macOS virtualization.framework, Windows Hyper-V). The +default agent templates include a private Docker daemon, so `docker build` and +`docker compose up` run inside the sandbox without affecting your host. + +```plaintext +Host system + ├── Your containers and images + ├── Sandbox VM 1 + │ ├── Docker daemon (isolated) + │ ├── Agent container + │ └── Containers created by agent + └── Sandbox VM 2 + ├── Docker daemon (isolated) + └── Agent container +``` + +Your workspace syncs bidirectionally between host and sandbox at the same +absolute path. Outbound internet goes through an HTTP/HTTPS filtering proxy on +the host. See [Network policies](#network-policies) for configuration. + +## Network policies + +The filtering proxy controls what a sandbox can access. By default, all +traffic is allowed except private networks and localhost. + +Allow mode (block specific destinations): + +```console +$ docker sandbox network proxy my-sandbox \ + --policy allow \ + --block-cidr 10.0.0.0/8 +``` + +Deny mode (allow specific destinations): + +```console +$ docker sandbox network proxy my-sandbox \ + --policy deny \ + --allow-host api.anthropic.com \ + --allow-host "*.npmjs.org" +``` + +View what an agent is accessing: + +```console +$ docker sandbox network log +``` + +## Custom templates + +Build custom templates to pre-install tools: + +```dockerfile +FROM docker/sandbox-templates:claude-code + +USER root +RUN apt-get update && apt-get install -y build-essential \ + && rm -rf /var/lib/apt/lists/* +USER agent +``` + +```console +$ docker build -t my-template:v1 . +$ docker sandbox run -t my-template:v1 claude ~/project +``` + +## Base environment + +All agent templates share a common environment: + +- Ubuntu 25.10 +- Docker CLI (with Buildx and Compose), Git, GitHub CLI, Node.js, Go, Python 3, uv, make, jq, ripgrep +- Non-root `agent` user with sudo access +- Package managers: apt, pip, npm + +## Troubleshooting + + + +### 'sandbox' is not a docker command + + + +The CLI plugin isn't installed or isn't in the correct location. Verify the +plugin exists at `~/.docker/cli-plugins/docker-sandbox` and restart Docker +Desktop. + +### Beta features need to be enabled + +If your Docker Desktop is managed by an administrator with +[Settings Management](/enterprise/security/hardened-desktop/settings-management/), +ask them to +[allow beta features](/enterprise/security/hardened-desktop/settings-management/configure-json-file/#beta-features). + +### Authentication failure + +Verify your API key is valid and set in your shell configuration file (not +just exported in the current session). Source the file and restart Docker +Desktop. + +### Permission denied on workspace files + +Check **Docker Desktop** > **Settings** > **Resources** > **File Sharing** and +ensure your workspace path is listed. Verify file permissions with `ls -la`. + +### Sandbox crashes on Windows + +If launching multiple sandboxes causes crashes, end all `docker.openvmm.exe` +processes in Task Manager and restart Docker Desktop. Launch sandboxes one at a +time. + +### Persistent issues + +Reset all sandbox state: + +```console +$ docker sandbox reset +``` + +This stops all VMs and deletes all sandbox data. Create fresh sandboxes +afterward. diff --git a/content/manuals/retired.md b/content/manuals/retired.md index 2b5401bfd6b..5372bf0dc73 100644 --- a/content/manuals/retired.md +++ b/content/manuals/retired.md @@ -145,9 +145,12 @@ project requirements. ### Docker Desktop sandboxes Docker Desktop sandboxes let users run AI coding agents in isolated microVMs -through the `docker sandbox` command. The `docker sandbox` plugin was removed -in Docker Desktop 4.80.0. Use the standalone -[`sbx` CLI](/manuals/ai/sandboxes/_index.md) instead. +through the `docker sandbox` command. The Docker Desktop integration is +deprecated. Use the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md) +instead. + +You can still view the +[Docker Desktop sandboxes documentation](/manuals/ai/sandboxes/docker-desktop.md). ### Docker Scout features diff --git a/data/cli/sandbox/docker_sandbox.yaml b/data/cli/sandbox/docker_sandbox.yaml new file mode 100644 index 00000000000..1b8a76efb53 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox.yaml @@ -0,0 +1,64 @@ +command: docker sandbox +short: Docker Sandbox +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Local sandbox environments for AI agents, using Docker. +usage: docker sandbox +pname: docker +plink: docker.yaml +cname: + - docker sandbox create + - docker sandbox exec + - docker sandbox ls + - docker sandbox network + - docker sandbox reset + - docker sandbox rm + - docker sandbox run + - docker sandbox save + - docker sandbox stop + - docker sandbox version +clink: + - docker_sandbox_create.yaml + - docker_sandbox_exec.yaml + - docker_sandbox_ls.yaml + - docker_sandbox_network.yaml + - docker_sandbox_reset.yaml + - docker_sandbox_rm.yaml + - docker_sandbox_run.yaml + - docker_sandbox_save.yaml + - docker_sandbox_stop.yaml + - docker_sandbox_version.yaml +options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create.yaml b/data/cli/sandbox/docker_sandbox_create.yaml new file mode 100644 index 00000000000..28f02d39c93 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create.yaml @@ -0,0 +1,148 @@ +command: docker sandbox create +short: Create a sandbox for an agent +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for an agent. + + Available agents are provided as subcommands. Use "create AGENT --help" for agent-specific options. +usage: docker sandbox create [OPTIONS] AGENT WORKSPACE +pname: docker sandbox +plink: docker_sandbox.yaml +cname: + - docker sandbox create cagent + - docker sandbox create claude + - docker sandbox create codex + - docker sandbox create copilot + - docker sandbox create gemini + - docker sandbox create kiro + - docker sandbox create opencode + - docker sandbox create shell +clink: + - docker_sandbox_create_cagent.yaml + - docker_sandbox_create_claude.yaml + - docker_sandbox_create_codex.yaml + - docker_sandbox_create_copilot.yaml + - docker_sandbox_create_gemini.yaml + - docker_sandbox_create_kiro.yaml + - docker_sandbox_create_opencode.yaml + - docker_sandbox_create_shell.yaml +options: + - option: name + value_type: string + description: | + Name for the sandbox (default: -, letters, numbers, hyphens, underscores, periods, plus signs and minus signs only) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: pull-template + value_type: string + default_value: missing + description: | + Template image pull policy: always (always pull from registry), missing (pull only if not cached), never (use only cached images) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: quiet + shorthand: q + value_type: bool + default_value: "false" + description: Suppress verbose output + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: template + shorthand: t + value_type: string + description: | + Container image to use for the sandbox (default: agent-specific image) + details_url: '#template' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create a Claude sandbox + + ```console + $ docker sandbox create claude ~/my-project + ``` + + ### Create with a custom name + + ```console + $ docker sandbox create --name my-sandbox claude ~/my-project + ``` + + ### Use a custom base image (-t, --template) {#template} + + ```text + --template IMAGE + ``` + + Specify a custom container image to use as the sandbox base: + + ```console + $ docker sandbox create --template python:3-alpine claude ~/my-project + ``` + + By default, each agent uses a pre-configured image. + + ### Create and run immediately + + After creating a sandbox, use `run` to start the agent: + + ```console + $ docker sandbox create --name my-sandbox claude ~/my-project + $ docker sandbox run my-sandbox + ``` + + Or use `docker sandbox run` directly to create and run in one step: + + ```console + $ docker sandbox run claude ~/my-project + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_cagent.yaml b/data/cli/sandbox/docker_sandbox_create_cagent.yaml new file mode 100644 index 00000000000..200fe86668a --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_cagent.yaml @@ -0,0 +1,66 @@ +command: docker sandbox create cagent +short: Create a sandbox for cagent +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for cagent. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start cagent after creation. +usage: docker sandbox create cagent WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create a Cagent sandbox in the current directory + + ```console + $ docker sandbox create cagent . + ``` + + ### Create with an absolute path + + ```console + $ docker sandbox create cagent /home/user/my-project + ``` + + ### Create and then run + + ```console + $ docker sandbox create --name my-cagent cagent ~/my-project + $ docker sandbox run my-cagent + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_claude.yaml b/data/cli/sandbox/docker_sandbox_create_claude.yaml new file mode 100644 index 00000000000..7bef660a7a4 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_claude.yaml @@ -0,0 +1,77 @@ +command: docker sandbox create claude +short: Create a sandbox for claude +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for claude. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start claude after creation. +usage: docker sandbox create claude WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +options: + - option: patch-settings + value_type: bool + default_value: "false" + description: Intercept claude settings API call and patch payload + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create a Claude sandbox in the current directory + + ```console + $ docker sandbox create claude . + ``` + + ### Create with an absolute path + + ```console + $ docker sandbox create claude /home/user/my-project + ``` + + ### Create and then run + + ```console + $ docker sandbox create --name my-claude claude ~/my-project + $ docker sandbox run my-claude + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_codex.yaml b/data/cli/sandbox/docker_sandbox_create_codex.yaml new file mode 100644 index 00000000000..0f415f8b7cb --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_codex.yaml @@ -0,0 +1,66 @@ +command: docker sandbox create codex +short: Create a sandbox for codex +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for codex. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start codex after creation. +usage: docker sandbox create codex WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create a Codex sandbox in the current directory + + ```console + $ docker sandbox create codex . + ``` + + ### Create with an absolute path + + ```console + $ docker sandbox create codex /home/user/my-project + ``` + + ### Create and then run + + ```console + $ docker sandbox create --name my-codex codex ~/my-project + $ docker sandbox run my-codex + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_copilot.yaml b/data/cli/sandbox/docker_sandbox_create_copilot.yaml new file mode 100644 index 00000000000..06a6af12b28 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_copilot.yaml @@ -0,0 +1,47 @@ +command: docker sandbox create copilot +short: Create a sandbox for copilot +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for copilot. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start copilot after creation. +usage: docker sandbox create copilot WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_gemini.yaml b/data/cli/sandbox/docker_sandbox_create_gemini.yaml new file mode 100644 index 00000000000..6d3a6231826 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_gemini.yaml @@ -0,0 +1,66 @@ +command: docker sandbox create gemini +short: Create a sandbox for gemini +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for gemini. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start gemini after creation. +usage: docker sandbox create gemini WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create a Gemini sandbox in the current directory + + ```console + $ docker sandbox create gemini . + ``` + + ### Create with an absolute path + + ```console + $ docker sandbox create gemini /home/user/my-project + ``` + + ### Create and then run + + ```console + $ docker sandbox create --name my-gemini gemini ~/my-project + $ docker sandbox run my-gemini + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_kiro.yaml b/data/cli/sandbox/docker_sandbox_create_kiro.yaml new file mode 100644 index 00000000000..23ef3a2d081 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_kiro.yaml @@ -0,0 +1,66 @@ +command: docker sandbox create kiro +short: Create a sandbox for kiro +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for kiro. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start kiro after creation. +usage: docker sandbox create kiro WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create a Kiro sandbox in the current directory + + ```console + $ docker sandbox create kiro . + ``` + + ### Create with an absolute path + + ```console + $ docker sandbox create kiro /home/user/my-project + ``` + + ### Create and then run + + ```console + $ docker sandbox create --name my-kiro kiro ~/my-project + $ docker sandbox run my-kiro + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_opencode.yaml b/data/cli/sandbox/docker_sandbox_create_opencode.yaml new file mode 100644 index 00000000000..132e0be55dd --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_opencode.yaml @@ -0,0 +1,66 @@ +command: docker sandbox create opencode +short: Create a sandbox for opencode +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for opencode. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start opencode after creation. +usage: docker sandbox create opencode WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create an OpenCode sandbox in the current directory + + ```console + $ docker sandbox create opencode . + ``` + + ### Create with an absolute path + + ```console + $ docker sandbox create opencode /home/user/my-project + ``` + + ### Create and then run + + ```console + $ docker sandbox create --name my-opencode opencode ~/my-project + $ docker sandbox run my-opencode + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_create_shell.yaml b/data/cli/sandbox/docker_sandbox_create_shell.yaml new file mode 100644 index 00000000000..f97e87bb06c --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_create_shell.yaml @@ -0,0 +1,47 @@ +command: docker sandbox create shell +short: Create a sandbox for shell +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Create a sandbox with access to a host workspace for shell. + + The workspace path is required and will be exposed inside the sandbox at the same path as on the host. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Use 'docker sandbox run SANDBOX' to start shell after creation. +usage: docker sandbox create shell WORKSPACE [EXTRA_WORKSPACE...] +pname: docker sandbox create +plink: docker_sandbox_create.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_exec.yaml b/data/cli/sandbox/docker_sandbox_exec.yaml new file mode 100644 index 00000000000..6e0643d473c --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_exec.yaml @@ -0,0 +1,201 @@ +command: docker sandbox exec +short: Execute a command inside a sandbox +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Execute a command in a sandbox that was previously created with 'docker sandbox create'. + + The command and any additional arguments are executed inside the sandbox container. +usage: docker sandbox exec [OPTIONS] SANDBOX COMMAND [ARG...] +pname: docker sandbox +plink: docker_sandbox.yaml +options: + - option: detach + shorthand: d + value_type: bool + default_value: "false" + description: 'Detached mode: run command in the background' + details_url: '#detach' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: detach-keys + value_type: string + description: Override the key sequence for detaching a container + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: env + shorthand: e + value_type: stringArray + default_value: '[]' + description: Set environment variables + details_url: '#env' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: env-file + value_type: stringArray + default_value: '[]' + description: Read in a file of environment variables + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: interactive + shorthand: i + value_type: bool + default_value: "false" + description: Keep STDIN open even if not attached + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: privileged + value_type: bool + default_value: "false" + description: Give extended privileges to the command + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: tty + shorthand: t + value_type: bool + default_value: "false" + description: Allocate a pseudo-TTY + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: user + shorthand: u + value_type: string + description: 'Username or UID (format: [:])' + details_url: '#user' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: workdir + shorthand: w + value_type: string + description: Working directory inside the container + details_url: '#workdir' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Execute a command in a sandbox + + ```console + $ docker sandbox exec my-sandbox ls -la + ``` + + ### Run an interactive shell + + ```console + $ docker sandbox exec -it my-sandbox /bin/bash + ``` + + ### Set environment variables (-e, --env) {#env} + + ```text + --env KEY=VALUE + ``` + + Pass environment variables to the command: + + ```console + $ docker sandbox exec \ + --env NODE_ENV=development \ + --env DATABASE_URL=postgresql://localhost/myapp \ + my-sandbox npm test + ``` + + ### Set working directory (-w, --workdir) {#workdir} + + ```text + --workdir PATH + ``` + + Run the command in a specific directory: + + ```console + $ docker sandbox exec --workdir /app my-sandbox python script.py + ``` + + ### Run as specific user (-u, --user) {#user} + + ```text + --user USER[:GROUP] + ``` + + Execute command as a different user: + + ```console + $ docker sandbox exec --user 1000:1000 my-sandbox id + ``` + + ### Run in background (-d, --detach) {#detach} + + Run a long-running command in the background: + + ```console + $ docker sandbox exec -d my-sandbox python server.py + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_inspect.yaml b/data/cli/sandbox/docker_sandbox_inspect.yaml new file mode 100644 index 00000000000..94b47738b6f --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_inspect.yaml @@ -0,0 +1,65 @@ +command: docker sandbox inspect +short: Display detailed information on one or more sandboxes +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Display detailed information on one or more sandboxes. + + This command retrieves and displays detailed information about the specified + sandboxes using the Docker API. Each sandbox is identified by its unique ID or name. +usage: docker sandbox inspect [OPTIONS] SANDBOX [SANDBOX...] +pname: docker sandbox +plink: docker_sandbox.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Inspect a sandbox + + ```console + $ docker sandbox inspect abc123def + [ + { + "id": "abc123def69b16c5c0dab4cf699e26f8d01e1ace3aeee06254e0999492e11647", + "name": "claude-sandbox-2025-11-04-170333", + "created_at": "2025-11-04T16:03:33.910642347Z", + "status": "running", + "template": "docker/sandbox-templates:claude-code", + "labels": { + "com.docker.sandbox.agent": "claude", + "com.docker.sandbox.workingDirectory": "/Users/moby/code/docker/sandboxes", + "com.docker.sandbox.workingDirectoryInode": "3041007", + "com.docker.sandboxes": "templates", + "com.docker.sandboxes.base": "ubuntu:questing", + "com.docker.sandboxes.flavor": "claude-code", + "com.docker.sdk": "true", + "com.docker.sdk.client": "0.1.0-alpha011", + "com.docker.sdk.container": "0.1.0-alpha012", + "com.docker.sdk.lang": "go", + "docker/sandbox": "true", + "org.opencontainers.image.ref.name": "ubuntu", + "org.opencontainers.image.version": "25.10" + } + } + ] + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_ls.yaml b/data/cli/sandbox/docker_sandbox_ls.yaml new file mode 100644 index 00000000000..9eccb54007b --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_ls.yaml @@ -0,0 +1,122 @@ +command: docker sandbox ls +aliases: docker sandbox ls, docker sandbox list +short: List VMs +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + List all VMs managed by sandboxd with their sandboxes +usage: docker sandbox ls [OPTIONS] +pname: docker sandbox +plink: docker_sandbox.yaml +options: + - option: json + value_type: bool + default_value: "false" + description: Output in JSON format + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: quiet + shorthand: q + value_type: bool + default_value: "false" + description: Only display VM names + details_url: '#quiet' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### List all VMs + + ```console + $ docker sandbox ls + VM ID NAME STATUS WORKSPACE SOCKET PATH SANDBOXES AGENTS + abc123def claude-vm running /home/user/my-project /Users/.../docker-1764682554072.sock 2 claude + def456ghi gemini-vm stopped /home/user/ml-projects + ``` + + ### Show only VM names (--quiet) {#quiet} + + ```text + --quiet + ``` + + Output only VM names: + + ```console + $ docker sandbox ls --quiet + claude-vm + gemini-vm + ``` + + ### JSON output (--json) + + ```text + --json + ``` + + Output detailed VM information in JSON format: + + ```console + $ docker sandbox ls --json + { + "vms": [ + { + "name": "claude-vm", + "agent": "claude", + "status": "running", + "socket_path": "/Users/user/.docker/sandboxes/vm/claude-vm/docker-1234567890.sock", + "sandbox_count": 2, + "workspaces": [ + "/home/user/my-project", + "/home/user/another-project" + ] + }, + { + "name": "gemini-vm", + "agent": "gemini", + "status": "stopped", + "sandbox_count": 0 + } + ] + } + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_network.yaml b/data/cli/sandbox/docker_sandbox_network.yaml new file mode 100644 index 00000000000..8b91cb27a5d --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_network.yaml @@ -0,0 +1,64 @@ +command: docker sandbox network +short: Manage sandbox networking +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Manage sandbox networking +usage: docker sandbox network +pname: docker sandbox +plink: docker_sandbox.yaml +cname: + - docker sandbox network log + - docker sandbox network proxy +clink: + - docker_sandbox_network_log.yaml + - docker_sandbox_network_proxy.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### View network logs + + ```console + $ docker sandbox network log + ``` + + ### Configure proxy for a sandbox + + ```console + $ docker sandbox network proxy my-sandbox --block-host example.com + ``` + + See the subcommands for more details: + - [`docker sandbox network log`](/reference/cli/docker/sandbox/network/log/) - Show network logs + - [`docker sandbox network proxy`](/reference/cli/docker/sandbox/network/proxy/) - Manage proxy configuration +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_network_log.yaml b/data/cli/sandbox/docker_sandbox_network_log.yaml new file mode 100644 index 00000000000..a336553cab3 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_network_log.yaml @@ -0,0 +1,132 @@ +command: docker sandbox network log +short: Show network logs +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Show network logs +usage: docker sandbox network log +pname: docker sandbox network +plink: docker_sandbox_network.yaml +options: + - option: json + value_type: bool + default_value: "false" + description: Output in JSON format + details_url: '#json' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: limit + value_type: int + default_value: "0" + description: Maximum number of log entries to show + details_url: '#limit' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: quiet + shorthand: q + value_type: bool + default_value: "false" + description: Only display log entries + details_url: '#quiet' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Show network logs + + ```console + $ docker sandbox network log + 2026-01-29T10:15:23Z sandbox=my-sandbox request GET https://api.example.com/data allowed + 2026-01-29T10:15:24Z sandbox=my-sandbox request POST https://api.example.com/submit allowed + 2026-01-29T10:15:25Z sandbox=my-sandbox request GET https://blocked.example.com/ denied + ``` + + ### Show only log entries (--quiet) {#quiet} + + ```text + --quiet + ``` + + Suppress headers and only show log entries: + + ```console + $ docker sandbox network log --quiet + 2026-01-29T10:15:23Z sandbox=my-sandbox request GET https://api.example.com/data allowed + 2026-01-29T10:15:24Z sandbox=my-sandbox request POST https://api.example.com/submit allowed + ``` + + ### Limit number of entries (--limit) {#limit} + + ```text + --limit N + ``` + + Show only the last N log entries: + + ```console + $ docker sandbox network log --limit 10 + ``` + + ### JSON output (--json) {#json} + + Output logs in JSON format for parsing: + + ```console + $ docker sandbox network log --json + { + "entries": [ + { + "timestamp": "2026-01-29T10:15:23Z", + "sandbox": "my-sandbox", + "type": "request", + "method": "GET", + "url": "https://api.example.com/data", + "action": "allowed" + } + ] + } + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_network_proxy.yaml b/data/cli/sandbox/docker_sandbox_network_proxy.yaml new file mode 100644 index 00000000000..4d08f755714 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_network_proxy.yaml @@ -0,0 +1,208 @@ +command: docker sandbox network proxy +short: Manage proxy configuration for a sandbox +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Manage proxy configuration for a sandbox +usage: docker sandbox network proxy [OPTIONS] +pname: docker sandbox network +plink: docker_sandbox_network.yaml +options: + - option: allow-cidr + value_type: string + description: | + Remove an IP range in CIDR notation from the block or bypass lists (can be specified multiple times) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: allow-host + value_type: string + description: Permit access to a domain or IP (can be specified multiple times) + details_url: '#allow-host' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: block-cidr + value_type: string + description: | + Block access to an IP range in CIDR notation (can be specified multiple times) + details_url: '#block-cidr' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: block-host + value_type: string + description: Block access to a domain or IP (can be specified multiple times) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: bypass-cidr + value_type: string + description: | + Bypass MITM proxy for an IP range in CIDR notation (can be specified multiple times) + details_url: '#bypass-cidr' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: bypass-host + value_type: string + description: | + Bypass MITM proxy for a domain or IP (can be specified multiple times) + details_url: '#bypass-host' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: policy + value_type: allow|deny + description: Set the default policy + details_url: '#policy' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Block access to a domain + + ```console + $ docker sandbox network proxy my-sandbox --block-host example.com + ``` + + ### Block multiple domains + + ```console + $ docker sandbox network proxy my-sandbox \ + --block-host example.com \ + --block-host malicious.site + ``` + + ### Block IP range (--block-cidr) {#block-cidr} + + ```text + --block-cidr CIDR + ``` + + Block access to an IP range in CIDR notation: + + ```console + $ docker sandbox network proxy my-sandbox --block-cidr 192.168.1.0/24 + ``` + + ### Allow specific domain (--allow-host) {#allow-host} + + ```text + --allow-host DOMAIN + ``` + + Permit access to a domain (useful with deny-by-default policy): + + ```console + $ docker sandbox network proxy my-sandbox \ + --policy deny \ + --allow-host api.trusted-service.com + ``` + + ### Bypass MITM proxy for domain (--bypass-host) {#bypass-host} + + ```text + --bypass-host DOMAIN + ``` + + Bypass MITM proxy for specific domains: + + ```console + $ docker sandbox network proxy my-sandbox --bypass-host localhost + ``` + + ### Bypass MITM proxy for IP range (--bypass-cidr) {#bypass-cidr} + + ```text + --bypass-cidr CIDR + ``` + + Bypass MITM proxy for an IP range: + + ```console + $ docker sandbox network proxy my-sandbox --bypass-cidr 127.0.0.0/8 + ``` + + ### Set default policy (--policy) {#policy} + + ```text + --policy allow|deny + ``` + + Set the default policy for network access: + + ```console + # Allow by default, block specific hosts + $ docker sandbox network proxy my-sandbox \ + --policy allow \ + --block-host dangerous.example + + # Deny by default, allow specific hosts + $ docker sandbox network proxy my-sandbox \ + --policy deny \ + --allow-host api.trusted.com \ + --allow-host cdn.trusted.com + ``` + + ### Remove rules + + Use `--allow-cidr` to remove IP ranges from block or bypass lists: + + ```console + $ docker sandbox network proxy my-sandbox --allow-cidr 192.168.1.0/24 + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_reset.yaml b/data/cli/sandbox/docker_sandbox_reset.yaml new file mode 100644 index 00000000000..af156092fb8 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_reset.yaml @@ -0,0 +1,92 @@ +command: docker sandbox reset +short: Reset all VM sandboxes and clean up state +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Reset all VM sandboxes and permanently delete all VM data. + + This command will: + - Stop all running VMs gracefully (30s timeout) + - Delete all VM state directories in ~/.docker/sandboxes/vm/ + - Clear image cache in ~/.docker/sandboxes/image-cache/ + - Clear all internal registries + + The daemon will continue running with fresh state after reset. + + ⚠️ WARNING: This is a destructive operation that cannot be undone! + All running agents will be forcefully terminated and their work will be lost. + Cached image tars will be deleted and will need to be recreated on next use. + + By default, you will be prompted to confirm (y/N). + Use --force to skip the confirmation prompt. +usage: docker sandbox reset [OPTIONS] +pname: docker sandbox +plink: docker_sandbox.yaml +options: + - option: force + shorthand: f + value_type: bool + default_value: "false" + description: Skip confirmation prompt + details_url: '#force' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Reset with confirmation prompt + + ```console + $ docker sandbox reset + ⚠️ WARNING: This will permanently delete all VM data and stop all running agents! + Are you sure you want to continue? (y/N): y + All VMs reset successfully + ``` + + ### Force reset without confirmation (-f, --force) {#force} + + Skip the confirmation prompt: + + ```console + $ docker sandbox reset --force + All VMs reset successfully + ``` + + > [!CAUTION] + > This is a destructive operation that cannot be undone! + > All running agents will be terminated and their work will be lost. +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_rm.yaml b/data/cli/sandbox/docker_sandbox_rm.yaml new file mode 100644 index 00000000000..dce4b78a0b8 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_rm.yaml @@ -0,0 +1,68 @@ +command: docker sandbox rm +aliases: docker sandbox rm, docker sandbox remove +short: Remove one or more sandboxes +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Remove one or more sandboxes and all their associated resources. + + This command will: + - Check if the sandbox exists + - Remove the sandbox and clean up its associated resources +usage: docker sandbox rm SANDBOX [SANDBOX...] +pname: docker sandbox +plink: docker_sandbox.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Remove a sandbox + + ```console + $ docker sandbox rm abc123def + abc123def + ``` + + ### Remove multiple sandboxes + + ```console + $ docker sandbox rm abc123def def456ghi + abc123def + def456ghi + ``` + + ### Remove all sandboxes + + ```console + $ docker sandbox rm $(docker sandbox ls -q) + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_run.yaml b/data/cli/sandbox/docker_sandbox_run.yaml new file mode 100644 index 00000000000..75d93705617 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_run.yaml @@ -0,0 +1,171 @@ +command: docker sandbox run +short: Run an agent in a sandbox +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Run an agent in a sandbox. Create the sandbox if it does not exist. + + Pass agent arguments after the "--" separator. + Additional workspaces can be provided as extra arguments. Append ":ro" to mount them read-only. + + Examples: + # Create and run a sandbox with claude in current directory + docker sandbox run claude + + # Create and run a sandbox with claude in current directory (explicit) + docker sandbox run claude . + + # Create and run with additional workspaces (read-only) + docker sandbox run claude . /path/to/docs:ro + + # Run an existing sandbox + docker sandbox run existing-sandbox + + # Run a sandbox with agent arguments + docker sandbox run claude -- --continue +usage: docker sandbox run SANDBOX [-- AGENT_ARGS...] | AGENT [WORKSPACE] [EXTRA_WORKSPACE...] [-- AGENT_ARGS...] +pname: docker sandbox +plink: docker_sandbox.yaml +options: + - option: detached + shorthand: d + value_type: bool + default_value: "false" + description: Return sandbox ID without running agent (hidden, for testing) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: name + value_type: string + description: 'Name for the sandbox (default: -)' + details_url: '#name' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: patch-settings + value_type: bool + default_value: "false" + description: Intercept claude settings API call and patch payload + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: pull-template + value_type: string + default_value: missing + description: | + Template image pull policy: always (always pull from registry), missing (pull only if not cached), never (use only cached images) + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: template + shorthand: t + value_type: string + description: | + Container image to use for the sandbox (default: agent-specific image) + details_url: '#template' + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Create and run Claude in the current directory + + ```console + $ docker sandbox run claude . + ``` + + ### Run an existing sandbox + + ```console + $ docker sandbox run my-sandbox + ``` + + ### Create and run with a specific workspace + + ```console + $ docker sandbox run claude ~/projects/my-app + ``` + + The workspace directory is mounted at the same absolute path inside the sandbox. + + ### Name the sandbox (--name) {#name} + + ```text + --name NAME + ``` + + Assign a custom name when creating a sandbox: + + ```console + $ docker sandbox run --name my-project claude . + ``` + + ### Use a custom base image (-t, --template) {#template} + + ```text + --template IMAGE + ``` + + Specify a custom container image when creating a sandbox: + + ```console + $ docker sandbox run --template python:3-alpine claude . + ``` + + By default, each agent uses a pre-configured image. The `--template` option + lets you substitute a different image. + + ### Pass arguments to the agent + + Use `--` to separate sandbox options from agent arguments: + + ```console + $ docker sandbox run claude . -- -p "What version are you running?" + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_save.yaml b/data/cli/sandbox/docker_sandbox_save.yaml new file mode 100644 index 00000000000..a326ad69ba6 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_save.yaml @@ -0,0 +1,64 @@ +command: docker sandbox save +short: Save a snapshot of the sandbox as a template +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Save a snapshot of the sandbox as a template. + + By default, the image is loaded into the host's Docker daemon (requires Docker to be running). + Use --output to save the image to a tar file instead. + + Examples: + # Load into host Docker (requires host Docker running) + docker sandbox save my-sandbox myimage:v1.0 + + # Save to file (works without host Docker) + docker sandbox save my-sandbox myimage:v1.0 --output /tmp/myimage.tar +usage: docker sandbox save SANDBOX TAG +pname: docker sandbox +plink: docker_sandbox.yaml +options: + - option: output + shorthand: o + value_type: string + description: | + Save image to specified tar file instead of loading into host Docker + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_stop.yaml b/data/cli/sandbox/docker_sandbox_stop.yaml new file mode 100644 index 00000000000..957b1ee275c --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_stop.yaml @@ -0,0 +1,63 @@ +command: docker sandbox stop +short: Stop one or more sandboxes without removing them +long: | + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Stop one or more sandboxes without removing them. The sandboxes can be restarted later. +usage: docker sandbox stop SANDBOX [SANDBOX...] +pname: docker sandbox +plink: docker_sandbox.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Stop a sandbox + + ```console + $ docker sandbox stop my-sandbox + my-sandbox + ``` + + ### Stop multiple sandboxes + + ```console + $ docker sandbox stop sandbox1 sandbox2 + sandbox1 + sandbox2 + ``` + + ### Stop all running sandboxes + + ```console + $ docker sandbox stop $(docker sandbox ls -q) + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false + diff --git a/data/cli/sandbox/docker_sandbox_version.yaml b/data/cli/sandbox/docker_sandbox_version.yaml new file mode 100644 index 00000000000..e7c0e3a9076 --- /dev/null +++ b/data/cli/sandbox/docker_sandbox_version.yaml @@ -0,0 +1,49 @@ +command: docker sandbox version +short: Show sandbox version information +long: |- + > [!WARNING] + > The Docker Desktop-integrated `docker sandbox` commands are deprecated and + > replaced by the standalone [`sbx` CLI](/manuals/ai/sandboxes/_index.md). + > This deprecation applies only to the Docker Desktop integration, not to Docker + > Sandboxes. + + Show sandbox version information +usage: docker sandbox version +pname: docker sandbox +plink: docker_sandbox.yaml +inherited_options: + - option: debug + shorthand: D + value_type: bool + default_value: "false" + description: Enable debug logging + deprecated: false + hidden: false + experimental: false + experimentalcli: false + kubernetes: false + swarm: false + - option: socket + value_type: string + description: | + Connect to daemon at specific socket path (for development/debugging) + deprecated: false + hidden: true + experimental: false + experimentalcli: false + kubernetes: false + swarm: false +examples: |- + ### Show version information + + ```console + $ docker sandbox version + github.com/docker/sandboxes/cli-plugin v0.7.1 f00f0d6473647c2201cd0507ce31613345c48ae6 + ``` +deprecated: false +hidden: false +experimental: false +experimentalcli: false +kubernetes: false +swarm: false +