docker/sbx-releases v0.43.0-rc4

on GitHub

Highlights

• Credential handling, signed-kit materialization, inherited Git configuration, and local-daemon identity checks have been hardened.
• Local workflows add Docker-style pruning, automatic idle shutdown, more portable environment files, and a 512 MiB minimum-memory option for shell use cases.

What's New

CLI

• Formerly built-in agents that moved to public kits (kiro, copilot, droid) can be launched by name again — sbx run kiro resolves the pinned replacement kit and its stored credentials work without extra approval steps.
• Add a last-used timestamp to sbx ls --json and Docker-style until filtering to sbx prune.
• sbx secret import and sbx secret ls now list copilot's GitHub credential correctly

Bug Fixes

• The CLI now honors configured system proxy settings for host-side HTTP clients.
• Hardened credential handling in the sandbox egress proxy so a client-supplied credential the proxy did not issue is not forwarded to managed provider hosts.
• Docker sign-in now explains how to recover when macOS Keychain denies access to stored credentials.
• Local sbx commands no longer wait on slow or unreachable update services before exiting.
• Fix HTTP/2 upstream responses without bodies being incorrectly framed as chunked by the sandbox proxy.
• Sandboxes created with sbx create now stop automatically after becoming idle.
• The CLI now honors configured system proxy settings during login and diagnostic uploads.
• sbx diagnose now reports the block size mkfs.erofs defaults to and warns when it exceeds the sandbox guest kernel's page size, which otherwise surfaces as an unexplained erofs ... invalid argument mount failure on Ampere, NVIDIA DGX Station, and Asahi hosts.
• fix sbx env rm so that it will detect a non-sbxenv sandbox correctly
• Hardened git kit cloning against command-line config injection (GIT_CONFIG_PARAMETERS and its numbered counterparts) carried in the inherited environment.
• Private registries can use an explicitly trusted cross-host authentication endpoint for sandbox pulls.
• SSH connections now remain bound to the original sandbox identity while preserving existing sandboxes during UUID migration.
• The tls.allowNegativeSerial setting no longer prints an informational log line on every sbx command while remaining visible in daemon diagnostics.
• Windows clients can now connect to sandboxd through filesystem AF_UNIX sockets.
• Fixed a bug where a single Docker Hub sign-in timeout could permanently lock the daemon out of Docker Hub, requiring a manual sign-in to recover.
• Fixed a bug where sbx git operations, including the commit identity used to provision a sandbox, could target the wrong repository when invoked with an inherited GIT_DIR environment variable (e.g. from within a git hook).
• Terminal output now uses default text colors when the background theme cannot be detected.
• Concurrent sandbox creates now reuse one Docker Hub authentication request.
• sbx secret rm --sandbox now immediately revokes the removed credential from the sandbox proxy.
• Nightly and development builds now report a version based on the latest stable release instead of a release-candidate tag.
• sbx diagnose no longer reports a missing SSH ProxyCommand in Git Bash when the Windows OpenSSH configuration is healthy.
• The local daemon now verifies connecting operating-system users on Unix sockets and Windows named pipes.
• Kits can now be installed through registry mirrors configured with an explicit port.
• Balanced policies now allow access to the NodeSource APT repository.
• Fixed kit-argument (${{ kit.args.* }}) substitution silently not applying when a kit reference is a symlinked directory.
• Network allow rules for IP-literal targets (for example sbx policy allow network [::1]:8080 or CIDR rules such as 10.0.0.0/8) are enforced correctly again; the proxy no longer blocks them with a default-deny after the governance approval-callback migration.
• Signed git kits now verify on every host: a kit checkout is materialized from the commit's blobs alone, so smudge filters, line-ending conversion, LFS, hooks, and other host git configuration can no longer alter the checked-out bytes.
• Fixed: agents no longer suggest sbx policy allow for a host blocked by an org-governed default-deny policy — it now reads as Blocked by org policy, same as an explicit org deny rule.
• Fixed sbx operating on an unrelated git repository when invoked from inside a git hook.
• Clone-mode sandboxes now support shallow Git repositories.
• Claude Code sandboxes started with sbx run --model now use the model you selected instead of the harness's own default model.
• Prevent sbx exec from synchronizing credentials that were not configured for the sandbox.
• Credential-binding consent now defaults to decline and clearly identifies when API-key secrets will be sent to new domains.
• Unrelated credentials no longer switch Claude sandboxes into Anthropic API-key mode.
• sbx@rc brew users on macOS will be updated to the latest stable build when it is released
• Fix UNC path resolution on Windows so that the same folder is identified correctly
• The minimum memory for a sandbox has been decreased to 512 MiB. Note: This is only suitable for shell use cases.
• MCP authorization supports private OAuth discovery with --skip-ssrf-check, falls back to advertised common OIDC scopes, and honors --no-scope for local OAuth registrations.

Other

• sbx run --model gains --overflow-provider/--overflow-model to pair a local model with a hosted one for oversized requests; --provider now works with codex for providers lacking the Responses API; codex sandboxes no longer spend seconds retrying WebSocket connections to the local model server.
• sbx mcp add can now send custom request headers to remote MCP servers via --header, with header values substituted from the local secret vault. MCP OAuth client secrets are renamed to mcp:<server>:client_secret (was mcp:<server>.client_secret), matching the header-secret naming; a secret stored under the old name is no longer read and must be re-set with sbx secret set mcp:<server>:client_secret.
• sbx env create and sbx env run will detect sandboxes that were not created by sbxenv instead of suggesting to the user otherwise
• Environment files can reference ${{ env.projectDir }} and ${{ env.fileDir }}, the user-level ~/.sbxenv.yaml can mount each project's own directory by declaring "workspace: ${{ env.projectDir }}", relative workspace paths now resolve against the file that declares them, and every "sbx env" subcommand accepts --name to override the sandbox name.
• sbx diagnose will now perform a mkfs.erofs check
• Commit-pinned git kits now resolve offline from a local content-addressed cache, and every cache hit verifies the checkout against a per-file manifest, so a tampered cache entry is quarantined and refetched instead of being served.
• Fixed the OAuth credential gate so a third-party kit re-declaring a built-in agent's OAuth service can no longer inherit that agent's trust and receive a real token without an explicit binding; sandboxes created before this fix now self-heal on the next daemon restart or kit add instead of requiring a manual recreate.
• daemon inspect and inspect will now show mount information
• sbx run --list-providers is removed; run llmman providers instead. A slow first launch of the bundled llmman no longer fails sbx run --model.
• Plain sbx version invocations now return embedded version information without full CLI startup.
• Claude sandboxes can now access the Claude Code documentation.
• sbx run --provider now accepts hosted models.dev providers, served through llmman; sbx run --list-providers lists them.
• Sandbox names are now validated to reject names longer than 63 characters or ending in a hyphen or period.
• sbx create/sbx run now share skills read-only by default via a new tri-state --skills=off|readonly|readwrite flag; the retired --no-share-skills flag still works as a deprecated alias for --skills=off. There is also a new skills.defaultMode to set the desired default behaviour.
• Fix terminal cursor flickering issue on Windows