Skip to content

sbx: document SOCKS5 upstream proxy and DOCKER_SANDBOXES_NO_PROXY #25537

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
craig-osterhout merged 1 commit into from
Jul 10, 2026
+12 −3
Merged

sbx: document SOCKS5 upstream proxy and DOCKER_SANDBOXES_NO_PROXY #25537

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions content/manuals/ai/sandboxes/architecture.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,15 +68,24 @@ and sets the upstream proxy for both HTTP and HTTPS to that URL. Unlike
`HTTP_PROXY` and `HTTPS_PROXY`, it doesn't affect image pulls or the daemon's
own requests.

`DOCKER_SANDBOXES_PROXY` accepts `http://`, `https://`, `socks5://`, and
`socks5h://` URLs. With `socks5://`, DNS is resolved locally before the
connection is handed to the proxy. With `socks5h://`, DNS resolution is
delegated to the proxy. Both schemes support credentials in the URL:
`socks5://user:pass@host:port`.

Set `DOCKER_SANDBOXES_NO_PROXY` to exclude specific destinations from
`DOCKER_SANDBOXES_PROXY`, using standard comma-separated `NO_PROXY` matching
semantics. This only affects traffic routed through `DOCKER_SANDBOXES_PROXY`

@docker-agent docker-agent Jul 10, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[LOW] Em dash joins two independent clauses (semicolon-equivalent usage)

The em dash on this line effectively joins two independent clauses the same way a semicolon would — which the style guide discourages (it advises writing two sentences instead). Consider splitting:

This only affects traffic routed through DOCKER_SANDBOXES_PROXY. Use NO_PROXY to exclude destinations from HTTP_PROXY/HTTPS_PROXY.

— use `NO_PROXY` to exclude destinations from `HTTP_PROXY`/`HTTPS_PROXY`.

Set these variables in the environment where the sandbox daemon starts. The
daemon starts automatically the first time a command needs it, so set the
variables before you run a `sbx` command. If the daemon is already running,
restart it for a change to take effect.

Two limitations apply:
One limitation applies:

- Only HTTP and HTTPS traffic can be forwarded to an upstream proxy. Other TCP
traffic can't be redirected to a proxy.
- Proxy auto-configuration files, such as `proxy.pac`, aren't supported. Set the
`HTTP_PROXY`, `HTTPS_PROXY`, or `DOCKER_SANDBOXES_PROXY` environment variables
explicitly.
Expand Down