sandboxes: document opt-in SSH agent forwarding - #25901
Draft
ilopezluna wants to merge 1 commit into
Draft
Conversation
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
SSH agent forwarding is no longer inherited implicitly from the daemon's environment. It requires explicit opt-in via ssh.agentForwardingEnabled, and each sandbox uses the client's SSH_AUTH_SOCK on create, start, or join, with ssh.agentSocketPath as an optional fixed override. Follows docker/sandboxes#5045. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
ilopezluna
force-pushed
the
sandboxes-ssh-agent-opt-in
branch
from
August 20, 2026 13:47
056cb31 to
22b1c53
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Updates the Docker Sandboxes docs for the SSH agent forwarding change in
docker/sandboxes#5045: forwarding is disabled by default and requires
explicit opt-in with
ssh.agentForwardingEnabled. When enabled, eachsandbox uses the
SSH_AUTH_SOCKsupplied by the client on create, start,or join, and
ssh.agentSocketPathremains available as an optional fixedoverride (for example, the 1Password agent socket).
Changes:
security/credentials.md— rewrote the SSH agent section: opt-insetting, dynamic per-client socket behavior, and the fixed socket path
override.
workflows.md— added enabling forwarding as the first step ofCommit signing.
troubleshooting.md— added the disabled-by-default check toSandbox commits aren't signed.
The
sbx setupand CLI reference changes ship through the vendoreddata/sbx_cli/files on the next vendor sync, so they aren't touched here.Note: the feature is merged upstream but not yet in a stable release
(lands after v0.39.0). Hold merging until the release ships.
Related issues or tickets
Reviews
🤖 Generated with Claude Code