v0.38.0-rc1

Highlights

Local models (experimental). sbx run --model <name> claude serves a local GGUF model via llmman — or an already-running Ollama install with an ollama/ prefix — and routes Claude Code at it instead of api.anthropic.com. Enable with sbx settings set platform.allowExperimentalFeatures true and sbx settings set feature.model true.

MCP management is now a first-class feature. Use sbx mcp --help to learn more.

Enterprise networking. Settings-driven upstream-proxy configuration with separate sandbox and daemon scopes, integrated NTLM/Kerberos proxy authentication on Windows, and a new --deny-network flag for per-sandbox egress rules at creation time.

Security hardening. SSH sessions no longer forward client environment variables into sandboxes, Claude Desktop SSH sessions no longer expose Desktop OAuth tokens, dynamic read-only mounts are enforced at the virtio-fs host edge, and sbx cp is patched against CVE-2026-17106.

What's New

CLI

• sbx create and sbx run show detailed structured progress during startup, including environment files loaded, resources provisioned, and each kit command's outcome; kit-install progress streams live during sbx create --kit.
• Added sbx daemon restart to stop and restart the sandboxd daemon in the background.
• sbx mount <sandbox> <host> without a container target now bind-mounts the host path at the same path inside the sandbox; :ro mounts are enforced read-only at the virtio-fs host edge so privileged sandbox processes cannot remount them read-write.
• sbx inspect now displays custom secrets configured for a sandbox.
• sbx run --gpu (experimental) opts a sandbox into NVIDIA VFIO GPU passthrough on Linux. (enable via sbx settings set feature.sandbox-gpu true
• DOCKER_SANDBOXES_CLONED_WORKSPACE_SIZE configures the size of the cloned workspace volume.
• sbx setup ssh warns when ssh is missing from PATH, and on Windows when sh (required by Claude Desktop's SSH ProxyCommand) is missing.
• Port publishing failures now identify the affected host port and explain when the OS requires extra daemon privileges.

MCP

• The sbx mcp subcommand is no longer hidden.
• Registering an MCP server with sbx mcp add refreshes the mcp-find/mcp-add index of every running sandbox, so new servers are discoverable without recreating sandboxes.
• The dynamic MCP tools (mcp-find, mcp-add, mcp-config-set) are now available in local sandbox mode.
• sbx mcp add supports --dir and OAuth override flags; a server's OAuth client secret is bound to the OAuth identity that uses it.
• Local MCP gateways use the hosted OAuth completion page and support state-aware authorization and revocation.
• Removed the sbx mcp bundle command; single-server management (sbx mcp add/ls/rm/...) is the supported flow.

Networking & Policy

• --deny-network HOST on sbx run and sbx create records per-sandbox network deny rules at creation time, with layer-aware egress messages.
• Added tls.allowNegativeSerial for TLS-inspecting proxies that issue certificates with negative serial numbers.
• sbx policy allow network reports a clear "managed by your organization" error when org governance overrides the local allow, and failed rule removals now explain what went wrong using a single rule identifier.
• Signing in refreshes organization policies in the running daemon immediately instead of waiting for the next polling interval.
• IP-literal destinations denied by a CIDR rule fail fast with a policy message instead of timing out.
• Blocked HTTPS proxy connections appear in sbx policy log even when the client aborts the TLS handshake.

Secrets & Credentials

• Service and custom secrets are global by default, with --sandbox for sandbox scope; legacy positional and --global forms are deprecated with warnings.
• Sandbox-scoped GitHub credentials added after creation now work without recreating the sandbox.
• Pressing Ctrl+C while entering a secret cancels the command without saving it.

Agents

• Docker Agent and OpenCode sandboxes can authenticate GitHub Copilot requests with proxy-managed GitHub credentials.
• Codex sandboxes created from the TUI prefer stored OpenAI OAuth credentials over API keys; kit environment variables now reach cloud agents, and git no longer hangs Codex startup prompting for credentials.
• Claude Vertex sandboxes support the us and eu multi-region endpoints.
• Gordon offers the working-directory and project-description tools even when sandbox management is unavailable.
• Shared agent skills: directory symlinks under the skills folder are resolved and their contents imported.

Kits & Templates

• Kit specs use the strict v2 grammar (permissions/setup/agentInstructions); the engine bundles sbx-kits-contrib v0.12.0.
• Kits using extends correctly inherit and override the base image or build source of their parent.
• Kit install commands can consume static files from files/home, including binary files.

Packaging

• Homebrew installs from a stapled .dmg artifact rather than a .tar.gz archive, improving Gatekeeper compatibility on macOS.
• Windows: the running sandboxd daemon is stopped during a WinGet/MSI upgrade so client and server end up on the same version.

Security

• SSH connections no longer forward client environment variables into sandboxes.
• Claude Desktop SSH sessions no longer expose Desktop OAuth access tokens inside sandboxes.
• Fixed a destination-escape flaw in sbx cp copy-out (CVE-2026-17106).
• The daemon's loopback egress proxy only serves the daemon's own traffic, preventing other local users on a multi-user host from reaching the configured upstream proxy through it.

Bug Fixes

• Fixed a hang where sandboxd stopped answering all endpoints and could not be stopped without SIGKILL after a crash; fatal daemon tracebacks are now included in sbx diagnose --upload bundles.
• Fixed sbx daemon stop hanging when an idle SSH session (e.g. Claude Desktop) was connected to a sandbox.
• sandboxd automatically repairs a corrupted local image cache by re-pulling the image, and otherwise reports a clear "run sbx daemon reset" error.
• Fixed recreate failures ("base image not found") after daemon restarts when swapping a sandbox's container via sbx kit add or sbx run --model; recreates self-heal by recomposing from the sandbox's template.
• Fixed reverse DNS (PTR) lookups from sandboxes returning NXDOMAIN for container-resolved addresses.
• Fixed a goroutine and network-endpoint leak from hijacked HTTP CONNECT tunnels that could eventually stall sandbox creation after many delete/recreate cycles.
• Fixed an intermittent 500 error when deleting a sandbox while its network endpoints were being torn down.
• The daemon restores saved sandboxes' network proxies in parallel on restart, speeding up startup with several sandboxes and fixing a potential crash during first-run policy application.
• Fixed host .git/config corruption when creating a sandbox for repositories using includeIf directives in ~/.gitconfig; the sandbox now writes git identity only to the container's gitconfig.
• The claude agent registers its MCP gateway at user scope, fixing MCP configuration for SSH sessions.
• New sandbox MCP gateways are scoped by Docker Hub user and retain correct ownership and cleanup state across restore, restart, and re-provisioning.
• Remote MCP gateways receive the sandbox's resolved organization ID for per-organization state.
• sbx skills shows a single usage form and clearer help for importing shared agent skills.
• sbx no longer reports that a stored credential was not injected when the daemon injects it.
• Repeated sbx run --model ... on an existing sandbox no longer re-pulls an already-present model or unnecessarily recreates the container, no longer prompts about API keys or shows spurious credential warnings, and no longer shows "Not logged in" for locally-routed models.