docs(sandboxes): credential bindings, kit spec v2#25369
Draft
dvdksn wants to merge 2 commits into
Draft
Conversation
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
The credentials page rework is well-structured and the new content (credential bindings, fail-closed mode, registry scope table) is accurate and useful. Three style violations in the newly-added content need attention before merge — all are bold misuse per the Docker style guide.
dvdksn
force-pushed
the
sandboxes-credentials-rework
branch
from
3697c5b to
75b13e9
Compare
Add a "Credential bindings" section documenting ~/.config/sbx/credentials.yaml — per-service discovery and allowedDomains scoping — and fail-closed mode (credentials.failClosed), including the first-use approval flow. Add the bindings form to the orientation table and cross-reference it from the kits credential section. Documents the intended fail-closed behavior; pending the daemon-routed create path honoring bindings (docker/sandboxes#3629). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Reframe the credential and kit-authoring docs to the v2 launch state: - credentials.md: credential bindings as the authorization mechanism, first-run approval (API key vs OAuth), fail-closed by default for schemaVersion 2 kits, environment variables sourced via a binding - kit-reference.md: default examples to schemaVersion "2"; add a "Schema versions" section + v1->v2 mapping; rewrite credentials (credentials[] / apiKey / oauth), network (caps.network), drop proxyManaged - kits.md, kit-examples.md: convert examples to v2 - agent pages: env-var auth now flows through a credential binding - troubleshooting.md: add the "no approved binding" failure Held as a draft until built-in agents move to schemaVersion 2. build-an-agent.md remains on v1 (separate follow-up). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dvdksn
force-pushed
the
sandboxes-credentials-rework
branch
from
5c7bd36 to
5200f4f
Compare
dvdksn
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Reworks the Docker Sandboxes credential and kit-spec documentation for the kit
schemaVersion: "2"model: user-controlled credential bindings, the first-runbinding-approval flow, and the v2 kit-authoring schema.
What's in this PR
Credential model (
security/credentials.md)~/.config/sbx/credentials.yaml) as the authorizationmechanism: per-service
discovery+allowedDomains.schemaVersion: "2"agents;credentials.failCloseddocumented as the override that extends the rule to older-schema kits.
host-env fallback for built-in agents.
Kit-authoring schema (
customize/kit-reference.md,kits.md,kit-examples.md)schemaVersion: "2".and auto-normalized, so migration is incremental.
credentials[]/apiKey/oauthshape(discovery moved to bindings); network →
caps.network;proxyManagedremoved.Supporting pages
binding.
troubleshooting.md: the "no approved binding" failure (non-interactive run ordeclined prompt).
Status
Note
Draft — intentionally held. This documents the end state once built-in
agents move to
schemaVersion: "2"and credential bindings become the default(gated on the built-in v2 migration, docker/sandboxes#3684). Publishing before
that ships would describe behavior most users wouldn't yet hit.
The kit-authoring schema changes (kit-reference / kits / examples) describe a
schema that already exists and could publish sooner; the end-user
credential-model changes (
credentials.md, agent pages, troubleshooting)should publish when the migration lands.
Open TODOs before publishing
they auto-bound on first run, or prompted to approve a binding? Tracked by an
inline
TODOincredentials.md.customize/build-an-agent.mdis still on the v1 schema — update in aseparate follow-up PR.
Generated by Claude Code