The sandboxd state directory on macOS
Two roots at the top: com.docker.sandboxes under Application Support, which holds sandboxes/sandboxd with sandboxd.sock and daemon.log and sandboxes/agent-skills, and com.docker.sandboxes under Logs, which holds sandboxes/auditkit with the audit JSONL files. Below, the symlink ~/.sbx/run points at the state directory and holds the containerd ttrpc socket, and a greyed box shows ~/.docker/sandboxes, the tree of the 2025 plugin.
com.docker.sandboxes/
~/Library/Application Support/
com.docker.sandboxes/
~/Library/Logs/
sandboxes/sandboxd/
sandboxd.sock
daemon.log
agent-skills/
sandboxes/agent-skills/
shared skills store
sandboxes/auditkit/
audit-<utc-timestamp>-
<process-uuid>-<seq>.jsonl
~/.sbx/run
symlink to the state directory
d/containerd/containerd.sock.ttrpc
~/.docker/sandboxes/
vm/<name>/, image-cache/
the 2025 docker sandbox plugin
deleted by docker sandbox reset
dashed border: a symlink, or the plugin tree that sbx does not use ยท teal: stored records