docker/sbx-releases v0.49.1

on GitHub

Highlights

Docker Sandboxes v0.49.1 improves kit compatibility, proxy support for cloud connections, and sandbox shutdown reliability.

What's new

Kits

• sbx kit validate and sbx kit inspect accept --offline to check a local directory or ZIP kit without starting the daemon or signing in.
• Creating sandboxes from local or Git v3 kits honors build-time --kit-arg values, including scoped overrides.
• Sandboxes combining multiple agent kits, such as Claude and Codex, start successfully and receive guidance in each agent's context file.
• On Windows, sandboxes can combine workload and mixin kits, including kits loaded through Windows junctions.
• Kits declaring multiple OAuth credentials authenticate every declared service.
• sbx kit sign warns when Git would change the signed file contents and invalidate signatures for git+ references.
• Reading a kit directory rejects unsupported entries, such as named pipes and device nodes, instead of hanging. sbx kit pack rejects symlinks that would produce an archive Sandboxes cannot load.

Sandbox lifecycle and workspaces

• SSH sessions start in the sandbox workspace, matching sbx exec.
• SSH-agent access granted by a kit continues working in running sandboxes after the daemon restarts.
• In newly created local sandboxes, Git preserves the host's ignore decisions for paths already present in the primary workspace. This applies to primary workspaces mounted at a Git repository root.
• Sandbox startup waits for Docker to become ready without launching competing Docker daemons.
• Daemon shutdown and sandbox reset no longer hang indefinitely when Docker is unresponsive or a kit registry operation stalls.
• Sandbox reset handles concurrent operations more reliably, avoids false cleanup warnings, and identifies sandboxes it could not fully remove.
• Port changes fail cleanly during sandbox creation or deletion, avoiding stale host bindings.
• SSH connection attempts fail cleanly when the daemon is shutting down.
• Cursor sandboxes no longer show an unexpected Workspace Trust prompt for workspace paths containing characters such as . or _.

Networking and cloud sandboxes

• Explicit CIDR deny rules take precedence over matching domain allow rules when Sandboxes resolves the destination address.
• Cloud commands, sbx move, the TUI, and cloud SSH honor configured proxies, including system and PAC proxies. Set proxy.sshDirect to true to connect cloud SSH directly on networks that permit direct SSH connections.
• sbx mcp add completes OAuth discovery on networks that require an HTTP proxy, without needing --skip-ssrf-check.
• Fixed uploads stalling while waiting for HTTP 100 Continue through intercepted HTTPS connections.
• Fixed a Windows system-proxy watcher hang that could prevent the daemon from stopping.
• Image pulls from public.ecr.aws work under the balanced network policy.
• sbx policy refresh immediately refreshes policy, for example after an AI Governance change, instead of waiting for the next polling interval. Existing connections remain open.
• sbx policy ls continues showing default-deny-all after a kit adds network rules.
• Cloud connection and authentication errors include guidance for resolving the problem.

Authentication and MCP

• Custom secrets using OPENAI_API_KEY or ANTHROPIC_API_KEY appear in the sandbox as expected.
• sbx secret set-custom warns before replacing a different host or environment-variable mapping under the same placeholder.
• sbx secret rm returns an error when no secret matches --registry, --placeholder, --host, or --env-name.
• MCP gateway code-mode tools work on Windows hosts.

CLI, settings, and diagnostics

• sbx policy ls, sbx settings ls, and sbx policy approval ls accept -q to print only rule IDs, setting keys, or approval IDs.
• Configure daemon log size and retention with sbx settings set using daemon.log.maxSizeMB, daemon.log.maxBackups, and daemon.log.maxAgeDays.
• The browser.enabled setting controls whether sandboxes can open the host browser.
• sbx env reports unknown keys and invalid values with their source file, line, column, and field. Invalid values in a base file must be fixed even if a later file overrides them; this also applies to ~/.sbxenv.yaml and sbx env rm.
• sbx settings set rejects incorrectly structured values for kit.allowedSources and kit.trustedSigners before saving them.
• sbx cp clearly reports a missing destination directory without extra tar errors.
• sbx diagnose reports running CLI and shim processes, warns when global network policy is not initialized, and detects a ZFS setting that can make image builds unusually slow.

Templates and installation

• Full templates now include a C/C++ toolchain for compiling native code inside the sandbox.
• The Linux tarball installer works for regular users on systems with AppArmor.