https://aitoolchain.io/tools/docker-sandboxes New releases and features in Docker Sandboxes, tracked by The AI Toolchain. en Wed, 19 Aug 2026 10:42:00 GMT https://github.com/docker/sbx-releases/releases/tag/v0.39.0 https://github.com/docker/sbx-releases/releases/tag/v0.39.0 Wed, 19 Aug 2026 10:42:00 GMT Docker Sandboxes v0.39.0 adds declarative `.sbxenv.yaml` environments, `sbx env` lifecycle commands, USB passthrough, bulk `sbx prune`, and kit signing via cosign. • New `sbx env run` command provisions a sandbox from `.sbxenv.yaml` and opens an interactive session; `sbx env create`, `sbx env exec`, and `sbx env rm` manage the full environment lifecycle. • New `.sbxenv.yaml` declarative environment file defines agent, workspace, kits, environment variables, secrets, registry credentials, ports, and resource limits — committable with a project for reproducible contributor environments. • Multiple `.sbxenv.yaml` files can be combined for shared configuration and local overrides, with host environment variable references for machine-specific paths and credentials. • New experimental `--usb` flag on `sbx create` (enabled via `DOCKER_SANDBOXES_FEATURE_SANDBOX_USB` environment variable) re-attaches specified USB devices into the sandbox via usbfs on Linux x86_64/ARM64. • New `sbx prune` command bulk-removes stopped sandboxes with filtering by how long each has been stopped, never touching running sandboxes. • `sbx run` and `sbx create` now accept `-e`/`--env` and `--env-file` to inject environment variables into a sandbox, following `docker run` precedence rules. • New `--provider ollama` flag on `sbx run --model` selects the Ollama backend, replacing the former `ollama/` model-name prefix. • `sbx secret set` and `sbx secret set-custom` now support dynamic secrets that resolve values from a reference or command, with options to control refreshing, verification, and error output. • Sandboxes now expose `SANDBOX_NAME` and `SANDBOX_ID` environment variables matching the values shown by `sbx ls --json`; the older `SANDBOX_VM_ID` is deprecated. • Claude Code's `/remote-control` endpoint can now be used inside sandboxes by enabling the `claude.remoteControl` setting via `sbx settings set claude.remoteControl true`. • New `platform.images.registryMirror` setting redirects Docker Hub-resolving sandbox template and kit images to an organization's registry mirror. • Kits can now be signed and verified with cosign-compatible Sigstore signatures via `sbx kit sign` / `sbx kit verify`, with optional policy enforcement at load time. • OAuth kits can now declare their credential file using the declarative `credentialFile.structure` form (rendered to well-formed JSON) instead of a free-form Go template. • `sbx diagnose` now reports free disk space on the volume holding sandbox data, detects broken/shadowed/stale SSH client configuration, and checks host virtualization support. Breaking changes: • `sbx run --model` no longer accepts an `ollama/` prefix to select the Ollama backend; use the new `--provider ollama` flag instead. https://github.com/docker/sbx-releases/releases/tag/v0.38.0 https://github.com/docker/sbx-releases/releases/tag/v0.38.0 Thu, 06 Aug 2026 09:00:25 GMT Docker Sandboxes v0.38.0 adds MCP gateway management, kit spec v2, GPU passthrough, per-sandbox network deny rules, and local GGUF model support. • Adds `sbx mcp` subcommand for registering and managing remote or local MCP servers, with a built-in MCP gateway that keeps OAuth credentials on the host. • Adds dynamic MCP tools `mcp-find`, `mcp-add`, and `mcp-config-set` for attaching registered MCP servers to sandboxes. • Adds `--deny-network HOST` flag to `sbx run` and `sbx create` to record per-sandbox network deny rules at creation time, with layer-aware egress messages. • Adds `sbx daemon restart` subcommand to stop and restart the sandboxd daemon in the background. • Introduces kit spec `schemaVersion: '2'` (v2 grammar) with clearer structure for setup, permissions, agent instructions, networking, and credentials; v1 kits continue to load via the legacy path. • Adds `DOCKER_SANDBOXES_CLONED_WORKSPACE_SIZE` environment variable to configure the size of the cloned workspace volume. • Experimental: adds `sbx run --gpu` for NVIDIA VFIO GPU passthrough on Linux, enabled via `sbx settings set feature.sandbox-gpu true`. • Experimental: adds `sbx run --model <name> claude` to run Claude Code against a local GGUF model; prefix with `ollama/` to use a model from an existing Ollama installation. • Experimental: adds `proxy`, `proxy.sandbox`, `proxy.daemon`, and matching `no_proxy` settings for separate proxy configuration scopes for sandbox and daemon traffic. • Experimental: adds `proxy.integratedAuth` setting on Windows to enable NTLM/Kerberos/Negotiate authentication to upstream proxies. • Experimental: adds `tls.allowNegativeSerial` setting (via `sbx settings set tls.allowNegativeSerial true`) for compatibility with TLS-inspecting proxies that issue certificates with negative serial numbers. • MCP server and tool registrations can be governed organization-wide using Cedar policies. • `sbx inspect` now displays custom secrets configured for a sandbox. • `sbx create` and `sbx run` show detailed structured startup progress, including environment files loaded, resources provisioned, and each kit command outcome; kit-install progress streams live during `sbx create --kit`. • Blocked HTTPS proxy connections now appear in `sbx policy log` even when the client aborts the TLS handshake. • Docker Agent and OpenCode sandboxes can authenticate GitHub Copilot requests with proxy-managed GitHub credentials. • Codex sandboxes created from the TUI prefer stored OpenAI OAuth credentials over API keys. • Kit install commands can now consume static files from `files/home`, including binary files. • Kits using `extends` correctly inherit and override the base image or build source of their parent. • Homebrew installs from a stapled `.dmg` artifact instead of a `.tar.gz` archive, improving Gatekeeper compatibility on macOS. • `sbx policy allow network` reports a clear error when org governance overrides a local allow rule. • Signing in refreshes organization policies in the running daemon immediately instead of waiting for the next polling interval. • IP-literal destinations denied by a CIDR rule now fail fast with a policy message instead of timing out. • Service and custom secrets are global by default, with `--sandbox` for sandbox scope; legacy positional and `--global` forms are deprecated with warnings.