docker/sbx-releases v0.51.0

on GitHub

Highlights

Docker Sandboxes v0.51.0 runs built-in agents from published kits and adds custom mount targets for additional workspaces, environment launch command defaults, and more controls for automation. It also strengthens workspace-copy and credential protections and improves network, MCP, and sandbox startup reliability.

Breaking changes

Built-in agents and shell images

Built-in agent names now resolve to published kits at docker.io/sbx/<name>:latest. This applies to Claude, Codex, Cursor, Devin, Docker Agent, OpenCode, Kiro, Copilot, and Droid. sbx run sbx/<kit> also accepts published kits, including kits named after built-in agents. The kit.allowExtractedAgents setting is removed.

• Sandboxes created by earlier releases from embedded Claude or Codex specifications keep running, but must be recreated before using sbx kit add, sbx run --model, or sbx move. Save files and unpushed commits before removing a sandbox.
• The shell agent now uses a published Debian 13 v3 kit. First use requires registry access. To provide shell sandboxes with provider credentials, add the shell-credentials mixin. Existing shell sandboxes keep running.
• V1 and v2 kits cannot be combined with v3 kits. Upgrade older mixins to v3 before combining them with the new built-in kits.
• The docker/sandbox-templates images for codex, cursor-agent, devin, docker-agent, and opencode, including their -docker variants, are no longer published.
• The docker/sandbox-templates:shell and :shell-docker images are no longer refreshed. For custom workloads, use docker.io/sbx/shell-image and docker.io/sbx/shell-docker-image.

Clipboard access and custom secrets

• Copying text from a local sandbox to the host clipboard now requires opting in with the clipboard.textCopy setting. Native clients such as Codex are supported.
• Custom secrets without destination hosts no longer substitute credentials. Repair existing mappings by adding explicit destination hosts while preserving their placeholders and other settings.

What's new

Security

• sbx cp blocks symbolic links in mounted directories from escaping onto other host paths. On Windows, it also blocks workspace escapes through substituted drives.
• Unix clients verify that daemon sockets belong to the same account before sending requests.
• sbx kit sign no longer runs configured Git filter drivers while checking signed file contents. Its recovery guidance preserves committed bytes even when repository attributes request line-ending conversion.
• Files replaced by Sandboxes on Windows retain their existing access control lists.
• Network policy commands reject empty --sandbox values instead of applying changes globally.

Kits and agents

• sbx kit add installs added image content in all-v3 sandboxes while preserving filesystem changes. sbx run --model generates a v3 model kit when the base uses v3.
• sbx kit inspect --resolved shows the kit with its extends parent merged in.
• Kit installation logs are saved inside the sandbox at /var/log/sbx-kits/<kit>/install-<n>.log. Progress shows command descriptions, and debug mode streams successful installation output and the startup log. Failed startup commands produce a warning with the log tail instead of failing sbx run.
• Kits can request publication of a host-loopback port when granted the required permission. Each request requires user approval and expires after 45 seconds.
• Kits declaring agent-context@2 guidance work with local and cloud sandboxes, including when they also offer agent-context@1.
• Optional kit credentials no longer prevent creation when absent. Kit changes after a daemon restart preserve stored Bedrock profiles, and recovery after a failed kit change preserves access to shared skills.
• Shell kits support custom templates, and v3 kits load correctly when their descriptor is named spec.yaml.
• Docker Hardened Images (DHI) kits are accepted by the default kit source allow list.
• GitHub Copilot authentication works when the GitHub secret is stored with --command or as a reference.

Sandbox lifecycle and workspaces

• Additional workspaces accept PATH:TARGET[:ro] with sbx create and sbx run. Environment files support the same custom targets through additionalWorkspaces[].target.
• sbx run --workdir starts the agent in a directory inside the workspace, including when reattaching to an existing sandbox.
• Environment files support entrypoint and cmd defaults for sbx env run. Command-line arguments can replace the default command. sandboxOptions also accepts rootSize, dockerSize, and clonedWorkspaceSize.
• Interactive sbx env exec offers to create a missing environment sandbox. Interactive sbx env run can adopt a matching existing sandbox when its environment records have been lost, after confirmation.
• New local sandboxes support FUSE filesystems, controlled through sandbox.fuse and the environment option sandboxOptions.fuse.
• Sandbox memory limits can be set up to the host's total memory, with a warning above 75%.
• Workspace, clone, kit-volume, and mount targets that would hide the shared skills store are rejected before creation or modification. Startup also explains how to recover when a file occupies the shared skills directory.
• sbx inspect shows the Sandboxes version that created a sandbox, for sandboxes created with this release onward. sbx ls, sbx inspect, and sbx prune --dry-run JSON include configured host bind mounts, including workspace, kit, and skills mounts. List and prune output also indicate missing mount sources. Existing workspace fields remain available.
• sbx ls reports unreadable sandbox state instead of silently omitting the sandbox. Clone failures include Git's underlying reason, such as dubious ownership.
• Resizing an interactive terminal during startup or shutdown no longer produces spurious errors. On Windows, Ctrl+Z no longer ends input forwarding, and automatically started daemons are less likely to stop when the launching command exits.

Networking and policy

• Linux hosts using split-horizon DNS, including VPN configurations with corporate nameservers, can reach internal HTTPS hosts through the sandbox proxy and retrieve proxy auto-configuration files from them.
• The proxy reuses upstream connections when injecting credentials, improving parallel downloads such as package installations.
• Bursts of outbound connections no longer crash the daemon when the host network stalls.
• Failed upstream connections for inspected HTTPS requests return a 502 response identifying the host and reason instead of an empty reply.
• sbx policy check http checks HTTP governance policy behavior.
• Policy listings keep the implicit default-deny fallback visible and distinguish it from explicit deny rules. Policy setup correctly identifies the local preset, and Gordon preserves HTTP rule restrictions.
• The policy TUI shows setup guidance after a reset, warns about stale rules, and resumes updates after setup. Storage failures report a server error instead of incorrectly requesting policy initialization.
• sbx reset reports how many user-added and approval-granted network rules it will remove, including with --force, and points to sbx policy init afterward.
• sbx ports accepts -p for --publish and identifies the destination sandbox port when a host port is already published.

Authentication, MCP, and models

• sbx secret set-custom --value-stdin reads a secret from standard input, avoiding secret values in command arguments.
• Daemon image pulls use the sbx login session and stored registry credentials. Published agent kits can be fetched through authenticated registry mirrors.
• Enable mcp.useServerNamePrefixes to prefix MCP tool names with their server name.
• sbx create and sbx run accept --static-mcp none to use static MCP mode without attaching servers.
• Approval-gated MCP calls proceed after approval, including with newer MCP clients. Server tools ending in -authorize or -revoke-auth are available again.
• MCP servers have more time to initialize, reducing startup timeouts. Code-mode sessions cancel in-flight tool calls on exit and handle parallel requests more reliably.
• sbx mcp auth and sbx mcp add suggest --client-id when a server refuses dynamic client registration.
• Set model.server.enabled to false, then run sbx daemon restart, to disable the bundled model server and its inference-runtime download.

Cloud sandboxes

• Kit updates no longer fail with “Template has N running sandboxes” while sandboxes using an earlier version are running.
• Building source kits uses less temporary disk space during upload.
• Volume names tolerate surrounding whitespace and reject whitespace-only values. Cloud launches reject local-only model overflow flags instead of silently ignoring them.
• Port listings include the reported protocol in JSON and YAML output. sbx move --ttl accepts case-insensitive duration units.
• Help and shell completion identify supported cloud options and explain file-transfer limitations for symbolic links and empty directories.

CLI, settings, and diagnostics

• --no-input prevents interactive prompts, including Docker sign-in, and reports the command needed to continue.
• sbx run --no-progress suppresses creation progress while retaining command results. sbx create --no-progress still prompts for cloud network-policy confirmation when needed.
• sbx --version prints the client version without starting the daemon. Canceled sandbox and environment creation exits with status 130 and a clear message.
• Persistently disable local CLI and daemon telemetry with sbx settings set telemetry.disabled true. The next CLI invocation uses the preference; run sbx daemon restart to apply it to a running daemon.
• Compatibility errors and stale engine tasks identify sbx daemon restart as the recovery command. Daemon startup failures show only the current attempt's error output, preserving line breaks.
• Windows SSH configuration works with both native OpenSSH and Git Bash OpenSSH. sbx diagnose detects missing Windows shell support for Claude Desktop SSH connections and warns when the state directory uses eCryptfs, which can cause image-pull I/O errors.
• Command help and empty-list hints provide clearer next steps for secrets, MCP servers, skills, cloud sandboxes, and template recovery.