docker/sbx-releases v0.43.0-rc3

on GitHub

Highlights

• The sbx GUI now ships with macOS and Windows installs.
• Cloud sandboxes now resume live agent sessions, reconnect after idle network drops, publish kit-declared ports, and consistently apply kit egress and credentials.
• Credential handling, signed-kit materialization, inherited Git configuration, and local-daemon identity checks have been hardened.
• Local workflows add Docker-style pruning, automatic idle shutdown, more portable environment files, and a 512 MiB minimum-memory option for shell use cases.

What's New

CLI

• Add a last-used timestamp to sbx ls --json and Docker-style until filtering to sbx prune.
• sbx --cloud run and sbx --cloud create now publish a kit's declared tcp ports and print their public URLs.

Daemon

• The sandbox create API accepts client-supplied container labels and OCI annotations, and GET /sandbox can filter sandboxes by label or annotation.

Agents

• sbx secret import and sbx secret ls now list copilot's GitHub credential correctly, and formerly built-in agents resolve from a pinned, content-verified kit revision instead of the community repo's latest commit.

Bug Fixes

• The CLI now honors configured system proxy settings for host-side HTTP clients.
• Hardened credential handling in the sandbox egress proxy so a client-supplied credential the proxy did not issue is not forwarded to managed provider hosts.
• Docker sign-in now explains how to recover when macOS Keychain denies access to stored credentials.
• Fix cloud sandbox creation failing when an agent kit's background apt-get refresh runs long.
• Local sbx commands no longer wait on slow or unreachable update services before exiting.
• Fix HTTP/2 upstream responses without bodies being incorrectly framed as chunked by the sandbox proxy.
• Fix sbx --cloud create and sbx --cloud run dropping an agent kit's declared network egress when --allow-network or --deny-network was also passed.
• Sandboxes created with sbx create now stop automatically after becoming idle.
• The CLI now honors configured system proxy settings during login and diagnostic uploads.
• sbx diagnose now reports the block size mkfs.erofs defaults to and warns when it exceeds the sandbox guest kernel's page size, which otherwise surfaces as an unexplained erofs ... invalid argument mount failure on Ampere, NVIDIA DGX Station, and Asahi hosts.
• fix sbx env rm so that it will detect a non-sbxenv sandbox correctly
• Hardened git kit cloning against command-line config injection (GIT_CONFIG_PARAMETERS and its numbered counterparts) carried in the inherited environment.
• Private registries can use an explicitly trusted cross-host authentication endpoint for sandbox pulls.
• SSH connections now remain bound to the original sandbox identity while preserving existing sandboxes during UUID migration.
• The tls.allowNegativeSerial setting no longer prints an informational log line on every sbx command while remaining visible in daemon diagnostics.
• Windows clients can now connect to sandboxd through filesystem AF_UNIX sockets.
• Fixed a bug where a single Docker Hub sign-in timeout could permanently lock the daemon out of Docker Hub, requiring a manual sign-in to recover.
• Fixed a bug where sbx git operations, including the commit identity used to provision a sandbox, could target the wrong repository when invoked with an inherited GIT_DIR environment variable (e.g. from within a git hook).
• Terminal output now uses default text colors when the background theme cannot be detected.
• Concurrent sandbox creates now reuse one Docker Hub authentication request.
• sbx secret rm --sandbox now immediately revokes the removed credential from the sandbox proxy.
• Nightly and development builds now report a version based on the latest stable release instead of a release-candidate tag.
• sbx diagnose no longer reports a missing SSH ProxyCommand in Git Bash when the Windows OpenSSH configuration is healthy.
• The local daemon now verifies connecting operating-system users on Unix sockets and Windows named pipes.
• Kits can now be installed through registry mirrors configured with an explicit port.
• Balanced policies now allow access to the NodeSource APT repository.
• Fixed kit-argument (${{ kit.args.* }}) substitution silently not applying when a kit reference is a symlinked directory.
• sbx --cloud exec -it no longer fails with "invalid terminal size" when run under a wrapper PTY that reports no size.
• Network allow rules for IP-literal targets (for example sbx policy allow network [::1]:8080 or CIDR rules such as 10.0.0.0/8) are enforced correctly again; the proxy no longer blocks them with a default-deny after the governance approval-callback migration.
• Signed git kits now verify on every host: a kit checkout is materialized from the commit's blobs alone, so smudge filters, line-ending conversion, LFS, hooks, and other host git configuration can no longer alter the checked-out bytes.
• Fixed: agents no longer suggest sbx policy allow for a host blocked by an org-governed default-deny policy — it now reads as Blocked by org policy, same as an explicit org deny rule.
• Fixed sbx operating on an unrelated git repository when invoked from inside a git hook.
• Clone-mode sandboxes now support shallow Git repositories.
• Claude Code sandboxes started with sbx run --model now use the model you selected instead of the harness's own default model.
• sbx --cloud with no command now opens the TUI dashboard. --cloud-api-url and DOCKER_CLOUD_API_URL now take the API base URL, and values ending in /v1 keep working. sbx run --cloud sizes the agent's terminal correctly at startup. The dashboard's cloud create now publishes kit-declared ports, and resume rejects --allow-network, --deny-network, and --env instead of silently ignoring them.
• Fatal cloud session errors now print on their own line instead of running into the interactive session's last output.
• sbx --cloud run/create now refuses gated agent variants (claude-bedrock, claude-vertex) consistently, instead of creating an unusable sandbox when sizing or platform flags are set.
• Cloud kit launches now export the credential variables a kit marks proxyManaged into the sandbox environment as sentinels, matching local behavior, so agents that detect providers from the environment see them.
• Concurrent cloud bakes of the same agent or kit now wait for the bake already in progress and reuse its template instead of failing or deleting it.
• Interactive cloud sessions no longer disconnect after about a minute of quiet, and reconnect automatically when a load balancer or proxy drops the connection.
• Prevent sbx exec from synchronizing credentials that were not configured for the sandbox.
• Credential-binding consent now defaults to decline and clearly identifies when API-key secrets will be sent to new domains.
• Unrelated credentials no longer switch Claude sandboxes into Anthropic API-key mode.
• sbx@rc brew users on macOS will be updated to the latest stable build when it is released
• Fix UNC path resolution on Windows so that the same folder is identified correctly
• The minimum memory for a sandbox has been decreased to 512 MiB. Note: This is only suitable for shell use cases.

Other

• sbx run --model gains --overflow-provider/--overflow-model to pair a local model with a hosted one for oversized requests; --provider now works with codex for providers lacking the Responses API; codex sandboxes no longer spend seconds retrying WebSocket connections to the local model server.
• sbx mcp add can now send custom request headers to remote MCP servers via --header, with header values substituted from the local secret vault. MCP OAuth client secrets are renamed to mcp:<server>:client_secret (was mcp:<server>.client_secret), matching the header-secret naming; a secret stored under the old name is no longer read and must be re-set with sbx secret set mcp:<server>:client_secret.
• sbx env create and sbx env run will detect sandboxes that were not created by sbxenv instead of suggesting to the user otherwise
• Environment files can reference ${{ env.projectDir }} and ${{ env.fileDir }}, the user-level ~/.sbxenv.yaml can mount each project's own directory by declaring "workspace: ${{ env.projectDir }}", relative workspace paths now resolve against the file that declares them, and every "sbx env" subcommand accepts --name to override the sandbox name.
• The sbx GUI now ships with macOS and Windows installs.
• sbx diagnose will now perform a mkfs.erofs check
• Add Windows 10 22H2 support.
• Commit-pinned git kits now resolve offline from a local content-addressed cache, and every cache hit verifies the checkout against a per-file manifest, so a tampered cache entry is quarantined and refetched instead of being served.
• Fixed the OAuth credential gate so a third-party kit re-declaring a built-in agent's OAuth service can no longer inherit that agent's trust and receive a real token without an explicit binding; sandboxes created before this fix now self-heal on the next daemon restart or kit add instead of requiring a manual recreate.
• daemon inspect and inspect will now show mount information
• sbx run --list-providers is removed; run llmman providers instead. A slow first launch of the bundled llmman no longer fails sbx run --model.
• Plain sbx version invocations now return embedded version information without full CLI startup.
• Claude sandboxes can now access the Claude Code documentation.
• sbx --cloud attach and sbx --cloud run now resume a live agent session in the sandbox instead of always starting a new one.
• sbx run --provider now accepts hosted models.dev providers, served through llmman; sbx run --list-providers lists them.
• Sandbox names are now validated client-side to reject names longer than 63 characters or ending in a hyphen or period, and the interactive TUI now applies the same name validation as the CLI.
• sbx --cloud now prints how to get access (Docker Agentic Platform sign-up) when cloud access is denied, instead of a bare 403.
• Cloud launches of built-in agents no longer bake a reusable agent template; the agent's kit is applied server-side at create, making the first launch as fast as every launch.
• Added AI Governance upsell banner to the TUI governance tab, encouraging users to centralize policy management.
• sbx --cloud run/create with kits now shows a live spinner with elapsed time during the server-side kit apply and the kit bake, matching the local progress style; plain output prints the same step and closer rows the local kit stream produces.
• The dashboard's cloud create now applies the agent's kit and egress and binds stored secrets, like sbx --cloud create. Dashboard deletes no longer time out early.
• sbx create/sbx run now share skills read-only by default via a new tri-state --skills=off|readonly|readwrite flag; the retired --no-share-skills flag still works as a deprecated alias for --skills=off. There is also a new skills.defaultMode to set the desired default behaviour.
• Fix terminal cursor flickering issue on Windows

Additional changes

CLI

• Formerly built-in agents that moved to public kits (kiro, copilot, droid) can be launched by name again — sbx run kiro resolves the pinned replacement kit and its stored credentials work without extra approval steps.

Other

• Agents extracted from the engine to pinned kits keep working under a narrowed kit.allowedSources or kit.requireSignature, and stay first-party when their content matches the digest the engine pinned; set kit.allowExtractedAgents=false to enforce both settings on them like any other remote kit.