docker/sbx-releases v0.43.0 on GitHub

What's New

shareSkills in sbxenv.yaml (experimental feature) has been replaced with skills, skills may be set to off|readonly|readwrite.
MCP OAuth client secrets are renamed to mcp:<server>:client_secret (was mcp:<server>.client_secret), matching the header-secret naming; a secret stored under the old name is no longer read and must be re-set with sbx secret set mcp:<server>:client_secret.

Environment files can reference ${{ env.projectDir }} and ${{ env.fileDir }}, the user-level ~/.sbxenv.yaml can mount each project's own directory by declaring workspace: ${{ env.projectDir }}, relative workspace paths now resolve against the file that declares them, and every sbx env subcommand accepts --name to override the sandbox name.
sbx env run, sbx env create, and sbx env rm detect name conflicts with sandboxes created outside sbx env and provide guidance instead of treating them as environment-managed sandboxes.

Formerly built-in agents that moved to public kits (kiro, copilot, droid) can be launched by name again — sbx run kiro resolves the pinned replacement kit and its stored credentials work without extra approval steps.
sbx run --provider now accepts hosted models.dev providers, served through llmman.
sbx run --model gains --overflow-provider/--overflow-model to pair a local model with a hosted one for oversized requests; --provider now works with codex for providers lacking the Responses API; codex sandboxes no longer spend seconds retrying WebSocket connections to the local model server.
Claude Code sandboxes started with sbx run --model now use the model you selected instead of the harness's own default model.
A slow first launch of the bundled llmman no longer fails sbx run --model.

sbx create/sbx run now share skills read-only by default via a new tri-state --skills=off|readonly|readwrite flag; the retired --no-share-skills flag still works as a deprecated alias for --skills=off. There is also a new skills.defaultMode to set the desired default behaviour.
Commit-pinned git kits now resolve offline from a local content-addressed cache, and every cache hit verifies the checkout against a per-file manifest, so a tampered cache entry is quarantined and refetched instead of being served.
Signed git kits now verify on every host: a kit checkout is materialized from the commit's blobs alone, so smudge filters, line-ending conversion, LFS, hooks, and other host git configuration can no longer alter the checked-out bytes.
Fixed kit-argument (${{ kit.args.* }}) substitution silently not applying when a kit reference is a symlinked directory.
Kits can now be installed through registry mirrors configured with an explicit port.
Hardened git kit cloning against command-line config injection (GIT_CONFIG_PARAMETERS and its numbered counterparts) carried in the inherited environment.

Add a last-used timestamp to sbx ls --json and Docker-style until filtering to sbx prune.
Sandboxes created with sbx create now stop automatically after becoming idle.
The minimum memory for a sandbox has been decreased to 512 MiB. Note: This is only suitable for shell use cases.
Sandbox names are now validated to reject names longer than 63 characters or ending in a hyphen or period.
daemon inspect and inspect will now show mount information.
Clone-mode sandboxes now support shallow Git repositories.
Fixed an issue where the sbx CLI could select the wrong repository during Git-related setup tasks, such as loading kits or configuring workspaces, when Git environment variables were set on the host.
Fix UNC path resolution on Windows so that the same folder is identified correctly.
SSH connections now remain bound to the original sandbox identity while preserving existing sandboxes during UUID migration.
Windows clients can now connect to sandboxd through filesystem AF_UNIX sockets.
The local daemon now verifies connecting operating-system users on Unix sockets and Windows named pipes.

Docker sign-in now explains how to recover when macOS Keychain denies access to stored credentials.
Fixed a bug where a single Docker Hub sign-in timeout could permanently lock the daemon out of Docker Hub, requiring a manual sign-in to recover.
Concurrent sandbox creates now reuse one Docker Hub authentication request.
Private registries can use an explicitly trusted cross-host authentication endpoint for sandbox pulls.
sbx secret rm --sandbox now immediately revokes the removed credential from the sandbox proxy.
Prevent sbx exec from synchronizing credentials that were not configured for the sandbox.
Credential-binding consent now defaults to decline and clearly identifies when API-key secrets will be sent to new domains.
Fixed the OAuth credential gate so a third-party kit re-declaring a built-in agent's OAuth service can no longer inherit that agent's trust and receive a real token without an explicit binding; sandboxes created before this fix now self-heal on the next daemon restart or kit add instead of requiring a manual recreate.
Unrelated credentials no longer switch Claude sandboxes into Anthropic API-key mode.
sbx secret import and sbx secret ls now list copilot's GitHub credential correctly.

The CLI honors configured proxy settings for host-side HTTP requests, including login, diagnostic uploads, and update checks.
Fix HTTP/2 upstream responses without bodies being incorrectly framed as chunked by the sandbox proxy.
Hardened credential handling in the sandbox egress proxy so a client-supplied credential the proxy did not issue is not forwarded to managed provider hosts.
Network allow rules for IP-literal targets (for example sbx policy allow network [::1]:8080 or CIDR rules such as 10.0.0.0/8) are enforced correctly again; the proxy no longer blocks them with a default-deny after the governance approval-callback migration.
Fixed: agents no longer suggest sbx policy allow for a host blocked by an org-governed default-deny policy — it now reads as Blocked by org policy, same as an explicit org deny rule.
The balanced policy preset now allows access to the NodeSource APT repository.
Claude sandboxes can now access the Claude Code documentation.

sbx mcp add can now send custom request headers to remote MCP servers via --header, with header values substituted from the local secret vault.
MCP authorization supports private OAuth discovery with --skip-ssrf-check, falls back to advertised common OIDC scopes, and honors --no-scope for local OAuth registrations.

Local sbx commands no longer wait on slow or unreachable update services before exiting.
Plain sbx version invocations now return embedded version information without full CLI startup.
sbx diagnose checks whether mkfs.erofs is usable and warns if its default block size exceeds the sandbox kernel's page size.
sbx diagnose no longer reports a missing SSH ProxyCommand in Git Bash when the Windows OpenSSH configuration is healthy.
The tls.allowNegativeSerial setting no longer prints an informational log line on every sbx command while remaining visible in daemon diagnostics.
Terminal output now uses default text colors when the background theme cannot be detected.
Fix terminal cursor flickering issue on Windows.
Nightly and development builds now report a version based on the latest stable release instead of a release-candidate tag.
sbx@rc brew users on macOS will be updated to the latest stable build when it is released.