docker/sbx-releases v0.39.0-rc3

on GitHub

Highlights

Declarative sandbox environments. Define a complete, reproducible sandbox in a .sbxenv.yaml file, including the agent, workspace, kits, environment variables, secrets, registry credentials, ports, and resource limits. Commit the file with your project so contributors can launch the same environment with sbx env run. This feature is experimental.

What's New

Sandbox environments

• Use sbx env run to provision an environment from .sbxenv.yaml and open an interactive session.
• Use sbx env create, sbx env exec, and sbx env rm to manage the environment lifecycle.
• Combine multiple environment files for shared configuration and local overrides.
• Reference host environment variables in environment files for machine-specific paths and credentials.
• See the sandbox environment files documentation.

CLI

• Add an experimental --usb flag to sbx create behind the DOCKER_SANDBOXES_FEATURE_SANDBOX_USB environment variable to re-attach the specified USB devices. They will be available inside a sandbox via usbfs. Linux x86_64/ARM64 only.
• sbx run --model now selects the Ollama backend via a new --provider ollama flag instead of an ollama/ prefix on the model name.
• Stopped sandboxes can now be cleaned up in bulk with sbx prune, which never removes a running sandbox and can filter on how long each has been stopped.
• sbx run and sbx create now accept -e/--env and --env-file to set environment variables in a sandbox, following docker run precedence rules.

Secrets

• sbx secret set and sbx secret set-custom can now configure dynamic secrets that resolve values from a reference or command, with options to control refreshing, verification, and error output.

Daemon

• Sandboxes now expose their own identity as SANDBOX_NAME and SANDBOX_ID environment variables, matching the name and id shown by sbx ls --json; the older SANDBOX_VM_ID still carries the sandbox name but is deprecated.

Networking

• Claude Code's /remote-control can now be used inside sandboxes by enabling claude.remoteControl setting: sbx settings set claude.remoteControl true.

Bug Fixes

• sandboxd now removes the sandbox container immediately when container startup fails, so an interrupted sbx create/sbx run is less likely to leave the sandbox name unusable.
• Agent kits that declare a persistent volume without a size now get a 512 MB volume instead of a 50 GB one, which significantly reduces sandbox disk usage on the host.
• sbx now reports a clear error for an unrecognized command, subcommand, or sbx help topic instead of printing help and succeeding, and reports a mistyped command without first asking an unauthenticated user to sign in.
• Claude sandboxes now use around 3.9 GB less disk space on the host.
• Claude sandboxes can connect to required Anthropic services when using the locked-down network policy.
• sbx kit inspect now describes kits using kit-spec v2 field names and lists any deprecated fields a kit still relies on, and sbx kit validate now rejects OAuth credentials missing sentinels, a service, or a credential-file body.
• DNS lookups in a sandbox now succeed for any host that network policy allows on any port, including hosts allowed only on a non-standard port such as myhost:2222.
• sbx template load now fails with an error when an image import does not complete, instead of reporting success.
• Correct the sbx create --name help text and CLI reference, which incorrectly listed plus signs as valid sandbox-name characters and omitted the leading-alphanumeric and two-character-minimum rules.
• sbx reset now removes the Docker Sandboxes-managed block from ~/.ssh/config.
• sbx now reports the exit code when a sandbox container dies at startup, and rejects a template image built for a different CPU architecture with a clear message instead of failing after a 30-second wait.
• Signing in to Claude Code with an Anthropic Console API key now succeeds on repeat logins instead of failing with a 401 error.
• Fixed sbx cp failing on Windows when the local path has no directory component (e.g. sbx cp file.txt sandbox:/tmp/).
• sbx daemon restart now starts the daemon again after a stop that reports a failure but leaves no daemon running.

Other

• sbx diagnose now reports free disk space on the volume holding sandbox data, and diagnostics bundles include host disk totals.
• sbx diagnose now detects broken, shadowed, or stale SSH client configuration.
• sbx mcp auth <server> can now authorize Docker MCP catalog servers by name without a prior sbx mcp add; container-only variants point at their -remote sibling.
• Add a platform.images.registryMirror setting that redirects Docker Hub-resolving sandbox template and kit images to an organization's registry mirror.
• Filesystem policy denials now include the organization's support contact message, matching network denials.
• sbx now reports when the host cannot provide a hypervisor — including a Windows installation running inside a virtual machine without nested virtualization — instead of a generic "failed to run sandbox container" error, and sbx diagnose now checks host virtualization support.
• Kits can now be signed and verified with cosign-compatible Sigstore signatures via sbx kit sign / sbx kit verify, with optional policy enforcement at load time.
• OAuth kits can declare their credential file with the declarative credentialFile.structure form, rendered to well-formed JSON, instead of a free-form Go template.
• Ubuntu 25.10 packages are no longer published; Ubuntu 25.10 is end-of-life.