Confirmed by a file, or only reported
Two columns. The left column lists eight claims a recorded capture file confirms: the sentinel inside and the real secret outside, default deny on example.com:443, a private Docker Engine 29.8.1 inside, commits fetched through the sandbox-m101-clone remote, the proxy at gateway.docker.internal:3128, MCP_GATEWAY_URL set inside the sandbox, docker-agent toolsets printing 27 types, and ai/qwen3:4b answering on Docker Model Runner with no provider key set. The right column lists six claims. Five are reported without a test: a MITM proxy that re-signs HTTPS, libkrun as the VMM, a start in tens of milliseconds, a verified kit signature, and sbx policy approval missing from the help although a 403 body names it. One rose box marks the disputed exfiltration path.
CONFIRMED BY A CAPTURE FILE
REPORTED, NOT TESTED HERE
sentinel inside, real secret outside
10-env-sentinel.txt, 10-receiver.log
default deny on example.com:443
09-blocked.txt, 09-check-verbose.json
private Docker Engine 29.8.1 inside
04-guest.txt
fetched via sandbox-m101-clone
08-clone-host.txt
proxy gateway.docker.internal:3128
04-env.txt
MCP_GATEWAY_URL set inside
11-static-inside.txt
toolsets prints 27 types
16-toolsets.txt
ai/qwen3:4b on DMR, no key set
25-doctor.txt, 27-inside-run.txt
HTTPS re-signed by a MITM proxy
issue #12, not checked
the VMM is libkrun
talk 2026-01-14, unverified
a start in tens of milliseconds
talk 2026-02-10, K35 not run
a kit signature verifies
sbx kit sign, not recorded
sbx policy approval is not a command
403 body names it, never run
allowed host as exfiltration path
HN 2026-08-10, both sides printed