Finding sbx docs

Docker changes sbx often, reaching a second kit schema and first-class MCP management inside four months. Every skill here therefore records the date it was last checked against the docs. This skill is how that check happens.

The one trick worth memorizing: docs.docker.com serves .md for every docs URL. Append .md and you get clean markdown instead of a scraped page.

$ curl -s https://docs.docker.com/ai/sandboxes/customize/kit-reference.md

Build the mirror

$ skills/finding-sbx-docs/scripts/fetch-docs.sh

All 55 official pages land in references/docs/, relinked so they traverse offline, with an index at references/docs/README.md listing every page and a one-line blurb. The fetch takes a few seconds.

The mirror is deliberately not committed. It is Docker's documentation, copyright Docker, Inc. and licensed Apache-2.0, so the repository mirrors it rather than redistributing it. Absent directory means nobody has fetched yet, not that something broke.

Installed as a plugin, the mirror lands inside the plugin's cache directory and a plugin update wipes it. Re-running the script is the fix.

Find the page

1. Read references/docs/README.md. Its blurbs resolve most lookups without opening anything.
2. Grep the mirror for the exact flag, field, or error string.
3. Only then reach for the network, and reach for it with .md.

Never quote a literal command from mirrored prose without checking it against the live .md URL. The mirror was machine-summarized on the way in, and some inline shell was dropped, most visibly each agent page's default startup command.

Check whether a claim still holds

Ask in this order, stopping when one settles it:

1. sbx --version, against the version gate named in the skill's ## Last verified.
2. The release notes, or references/docs/release-notes.md for the mirrored copy.
3. The page that owns the claim.
4. sbx <cmd> --help, which outranks any command list including this one.

Where sbx is not installed, say so and hand back the exact command rather than reporting a result you did not observe.

Carry a change into the skills

references/docs.lock is committed even though the mirror is not. It holds a hash per page, so a refresh turns an invisible content change into a reviewable diff:

$ skills/finding-sbx-docs/scripts/fetch-docs.sh
$ git diff -- skills/finding-sbx-docs/references/docs.lock

Every changed line is a page that moved upstream. Work the list:

1. Map each changed page to its owning skill with the table below.
2. Read the page and find the claim that moved.
3. Correct the owning skill, or record that no claim was affected.
4. Move that skill's ## Last verified date, and name any new version gate inline.

Done means every changed page is accounted for, each one either an edit or an explicit no-op. A page left unexamined is the failure mode, because the verification date then vouches for prose nobody re-read.

Which skill owns which pages

release-notes belongs to all of them, because it is the page that says what changed.

Two pages split by reader rather than topic. Governance prose reaches governing-sbx-fleets for the administrator writing a policy, and diagnosing-sbx-sandboxes for the developer that policy blocked.

The scripts

scripts/fetch-docs.sh downloads, then hands off to scripts/relink-docs.py, which rewrites site-absolute links to local paths, adds breadcrumbs, and regenerates both the index and docs.lock. Both are idempotent.

Never run the fetch without the relink. Raw pages carry site-absolute links, so skipping it leaves a mirror that does not traverse offline.

Relinking repairs nothing on its own. It rewrites site-absolute links, and a link it already rewrote is no longer site-absolute, so a second pass leaves it untouched however wrong it is. Re-fetch to repair a mirror, rather than re-relinking one.

Several pages share a filename across directories, local.md and cursor.md among them. Links resolve on the deepest matching directory trail, so a wrong resolution shows up as a lock diff on a page nobody upstream touched. Suspect the mirror before believing the diff.

The fetch date lives in references/docs/.fetched and everything downstream reads it from there rather than from the clock. Relinking on its own must not age the mirror forward, because every ## Last verified section cites that date.

Last verified

Verified against the sbx docs of 2026-08-07 (re-fetched unchanged on 2026-08-10). The mirror layout and these scripts live in this repository, so they move with it rather than with sbx. What ages is the mirror itself: read the fetch date in references/docs/README.md before trusting a page, and re-fetch when the gap matters.