docker/sbx-releases v0.42.0-rc1

on GitHub

Highlights

• BREAKING: sbx ports --publish and kit-declared ports now default to tcp4 instead of dual-stack tcp, so a published port no longer listens on ::1 unless you name the protocol explicitly (--publish 8080:3000/tcp); this makes http://localhost:<port>/ reach a sandbox service that listens only on IPv4.
• sbx run and sbx create now accept sandbox kit references as the agent positional: sbx run <sandbox-kit-ref>. The old form sbx run <sandbox-kit-name> --kit <sandbox-kit-ref> is deprecated; use the --kit flag for mixins.
• Sandboxes can now be created without a workspace bind mount by omitting the path in sbx create. Note that this only affects the create command; sbx run still defaults to mounting the current directory as the primary workspace.

What's New

CLI

• Read-only sbx commands including secret ls, version, mcp ls, skills ls, policy inspect and the kit verification commands now accept --json for machine-readable output.
• Clipboard commands inside local sandboxes can now copy text to the host clipboard.
• Add, update, list, and remove sandbox skills directly from Git repositories with sbx skills.

Environment files

• sbx env now reads a non-hidden sbxenv.yaml in preference to .sbxenv.yaml when a directory holds both, and merges an sbxenv.yaml from your home directory beneath the project file as defaults shared across projects.
• sbx env now shows a plan of everything an environment file changes on the host — host lifecycle: commands, credentials, bindings, MCP servers, workspaces, kits, ports and the sandbox itself — asks before applying it and asks again for every run of a command on this machine unless env.rememberHostCommands is set, binds the environment file read-only into the sandbox it describes, and reads a directory for sbxenv.yaml alone with ~/.sbxenv.yaml as the user-level base beneath it.
• sbx env: an environment file that declares no workspace: now creates a sandbox with no workspace bind mount instead of mounting the directory holding the file; write workspace: . to mount the project directory.
• Environment files can now declare their own arguments in an args: block, referenced as ${{ env.args.NAME }} and supplied with sbx env --env-arg; ${VAR} interpolation in .sbxenv.yaml is no longer expanded.
• Relative kit paths in an environment file now resolve against the file's directory instead of the directory sbx was run from.
• sbx env create now shares imported skills by default and accepts display, GPU, and USB options in sbxenv.yaml.

Daemon

• Sandboxes now get a 10 GB Docker volume instead of 50 GB, which significantly reduces host disk usage; set the sandbox.disk.dockerVolume setting or DOCKER_SANDBOXES_DOCKER_SIZE to change it.

Agents

• The built-in droid agent has been removed — run it as a community kit with sbx run docker.io/sbx/droid-kit:latest.
• The built-in copilot agent has been removed — run it as a community kit with sbx run docker.io/sbx/copilot-kit:latest.
• The built-in kiro agent has been removed — run it as a community kit with sbx run docker.io/sbx/kiro-kit:latest.

Kits

• Kits can now declare their arguments in a args: block and receive values with --kit-arg name=value, or --kit-arg kit.name=value to target a single kit.
• A kits: entry in sbxenv.yaml carries the arguments for that kit under kits[].args.

Bug fixes

• Docker Sandboxes no longer opens the setup wizard automatically; run sbx setup to launch it explicitly.
• Fixed a vulnerability where a sandboxed process could get the daemon to open a host D-Bus transport and execute an arbitrary command on the host.
• On macOS, sbx now accepts a workspace path whose casing differs from the spelling on disk instead of failing to create the sandbox.
• Fixed a rare case where a spotty network right after your computer woke
  from sleep could cause an unexpected Docker Hub sign-out.
• Agent crashes now identify the terminating signal and provide scoped recovery guidance.
• Fixed a vulnerability where a malicious sandbox could hijack another sandbox's OAuth login by pre-claiming its callback port.
• Removing or pruning a local sandbox now also deletes its sandbox-scoped secrets.
• sbx secret ls no longer prints a stored secret unmasked when its value happens to match one of the status labels the listing displays.
• sbx now warns when a stored credential is not sent to a sandbox because no binding authorizes it, instead of starting the sandbox and failing later with an authentication error.
• Fixed several MCP-related bugs.
• Standardized error message formatting for sbx rm, sbx stop, MCP authorization, and sbx reset.
• Sandbox and agent not-found errors now use one sentence pattern and quote style across commands: sandbox '' not found.
• Fixed an egress policy bypass where a sandbox could reach a disallowed domain co-hosted on an allowlisted host's CDN by sending a different TLS SNI inside an HTTPS CONNECT tunnel; the proxy now enforces the network policy against the tunneled SNI.
• Docker Hub template pulls created through the TUI now use your Docker Sandboxes login credentials.
• sbx ports --publish now automatically starts stopped local sandboxes before publishing ports.
• Docker volume sizes below 512 MiB are now rejected before sandbox creation.
• Creating a sandbox from a Docker Hardened Image template no longer results in a delay.
• Fixed OAuth authentication for custom agent kits that declare resource hosts without a fallback API key.
• Kits can now set a sandbox's CPU and memory limits through the sandbox.resources block in their spec.
• Fix SSH connections from editors by keeping non-interactive probes quiet and delivering their exit status before closing the channel.
• Deleting a sandbox now reliably reclaims its disk volumes, and creating a new sandbox that reuses a deleted sandbox's name no longer inherits its files, Docker images or agent session history.
• Running sbx setup explicitly no longer causes the setup screen to appear again on the next interactive command.
• Fixed sandbox connections to a server that sends data first — including passive FTP transfers and a serial console relayed to the host — failing with a timeout instead of receiving the server's output.
• sbx kit push no longer uploads an empty payload layer for kits that ship no files.
• sbx kit push now authenticates from the sbx credential store, so a single sbx login or docker login is enough for pushing, signing, and attaching provenance.
• Kits using extends: now inherit the parent's setup commands, credentials, network allowlist, volumes, and environment variables instead of replacing them when the child declares its own.
• Fixed Docker Hub credential refresh retrying without backoff after a rate limit, and a non-interactive login discarding the stored OAuth refresh token.
• Nightly Homebrew installs no longer fail with checksum mismatches while a nightly publish is in flight: the sbx@nightly cask now downloads from immutable per-build release URLs.
• Fixed an issue with streamed response bodies in the sandbox's HTTP proxy that affected the Cursor agent.

Other

• Docker Sandboxes now provides a machine-wide Windows MSI for administrator-managed installations.
• A declined @requireApproval prompt on a local MCP server now gets its own audit record, with policy attribution and a context digest, instead of leaving the original approval-required decision as the only trace of the exchange.
• A registry mirror configured with platform.images.registryMirror is now also used by Docker running inside a sandbox, when the value is a bare host (no path prefix) that is not a loopback or wildcard address.
• sbx version --json now reports a server.state of running or unavailable, so scripts can check whether the backend was reachable without parsing the error text.
• SSH agent forwarding can be explicitly disabled and use either each client's current agent socket or a fixed socket path.
• sbx terminal output now adapts colours for light terminal backgrounds and
  uses a distinct pink spinner glyph; CJK and combining-mark column widths in
  table output are now measured correctly; piped and JSON output is unchanged
  for ASCII-only content.
• sbx mcp add now accepts --skip-auth (the old --skip_auth still works), and a --url on a private, loopback, or cloud-metadata address is resolved and registered with a warning instead of being rejected.
• On Linux hosts without an available OS keychain, newly stored secrets are now read and written much faster; secrets already on disk keep their previous cost until they are next written.
• Fixed a gateway defect where a remote MCP server's reconnect could silently wipe its tool routing, causing the server's tools to disappear from agents and be denied by organization MCP policy as unrecognized built-in tools until the daemon was restarted.
• Docker Sandboxes can now upload a diagnostics bundle automatically when the daemon hits an error, after you opt in.
• Governance resolution issues are now shown in sbx policy output and the dashboard
• sbx mcp auth now requests only the scopes you chose (or the set the resource itself requires, suppressible with the new --no-scope flag) instead of every scope a server advertises, explains which scopes a server refused along with a narrower retry command, and reports the scope sets of an existing grant in sbx mcp auth status: what was granted, what was requested, and what the server supports — with scopes sorted, duplicates collapsed, and differences such as unrequested or no-longer-advertised grants called out.
• Sandbox listing and creation output now share one rendering package; on a terminal, sbx ls column headers are now styled bold.
• Sandbox agent instruction files no longer include generic language-specific development guidance.
• The sandboxd runtime state directory left behind by versions before v0.25.0 is now migrated to its current name instead of being used in place.