# Conflicts register: Docker Sandboxes and Docker Agent 101

- Written: 2026-10-08. Synthesis only. No new web research.
- Inputs: `01-sandboxes.md`, `02-agent-cagent.md`, `03-stack.md`, `04-talks-community.md`, the help trees `cli/sbx.md` (sbx v0.47.0, 97 commands), `cli/sbx-cloud.md`, `cli/docker-agent.md` (docker-agent v1.149.0), the legacy captures `cli/sandbox.md` (plugin v0.12.0) and `cli/agent.md` (plugin v1.32.4), and every file under `cli/probes/`.
- Source id scheme: `01:S16` is source S16 of `01-sandboxes.md`; `02:S13`, `03:S24`, `04:T02`, `04:B05`, `04:HN01` follow the same rule. `cli:sbx`, `cli:sbx-cloud`, `cli:da` (docker-agent v1.149.0), `cli:sandbox` (legacy v0.12.0), `cli:agent` (legacy v1.32.4) name the help trees. `probe:<file>` names a file under `cli/probes/`. Fact numbers such as `01:F63` point at the numbered fact lists in the research files.
- Rows C113 to C122 were added after the capture run. They cite capture files by name and vendored sources by the keys of `manual.json` `quoteSources`, such as `kitspec`, `docs-sbx`, `docs-agent`, and `schema`, and `kit-spec-extras.md` by file name.
- Status values: `settled` (the manual prints one answer and names the evidence), `open` (the manual prints both claims and says which it follows), `run` (a capture in `07-capture-plan.md` settles it; the capture id is given).
- Kind values: `docs vs CLI`, `docs vs repo`, `docs vs docs`, `blog stale`, `talk vs docs`, `community vs docs`, `undocumented`, `experimental`, `removed`, `renamed`.
- The pin the register is checked against: sbx v0.47.0 (commit `0411f50ee4700fe7bd37e6e7e3aced563e850ca9`, released 2026-10-05), docker-agent v1.149.0 (2026-10-07), agent file schema version 16, Sandbox Kit Spec v3 milestone 3.0.0-m.8 (frontend `docker/sandbox-kit:3`, 2026-10-02), docker/model-runner v1.2.8 (2026-08-12), docker/mcp-gateway v0.44.1 (2026-09-23, prerelease), Compose v5.6.0 (2026-10-02), Docker Desktop 4.94.0 (2026-10-05). Verified 2026-10-08.

The register has 122 rows in nine groups. Rows C1 to C47 and C113 to C117 are sbx, C48 to C76 and C118 to C121 are docker-agent, C77 to C85 are Docker Model Runner, C86 to C93 are the MCP gateway and Toolkit, C94 to C97 are Compose, C98 to C100 are Offload, C101 to C106 are Cloud Sandboxes, C107 to C112 and C122 are the legacy plugins, and the last group lists stale advice in the wild as rows S1 to S30 for the migration section.

## Group A: sbx (the standalone CLI, the daemon, the microVM, the workspace, the network, secrets, MCP, kits, settings)

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C1 | The product is the Docker Desktop plugin `docker sandbox`. Desktop 4.80.0 says "Migrate to `docker sbx`". | The product is the standalone binary `sbx`. No `docker sbx` command exists in any help tree. | 01:S17 (2026-06-29), 01:S19 (v0.12.0), 01:S24 (2026-10-07), cli:sbx, probe:sbx-version | renamed | settled by cli:sbx and probe:sbx-version | The manual says `sbx` everywhere. `docker sandbox` was removed in Desktop 4.80.0 on 2026-06-29. `docker sbx` is a typo in a release note. |
| C2 | Standalone sbx launched 2026-03-31 (blog "YOLO Mode, Safely"); first public tag v0.21.0 is dated 2026-03-31. | "Last week, we launched Docker Sandboxes" on 2026-04-16; on 2026-04-07 Michael Irwin still called it "DS" and unreleased. | 01:S25, 01:S33, 04:B02, 04:B03, 04:T05 | blog stale | settled by the release tag (01:S25) | The first public tag is v0.21.0 on 2026-03-31. The April blog refers to the same launch window. |
| C3 | macOS uses "virtualization.framework"; Windows uses "Hyper-V (Experimental)" with `docker.openvmm.exe` processes. | Apple Hypervisor.framework on macOS, Windows Hypervisor Platform on Windows, KVM on Linux. | 01:S18 (2026-03-06), 01:S34 (2026-04-16), 01:S2 (2026-10-08), probe:sbx-diagnose (`kern.hv_support is 1`) | docs stale | settled for v0.47.0 by 01:S2 and probe:sbx-diagnose; Windows process name open | Print Hypervisor.framework, WHP, KVM. Do not name OpenVMM. |
| C4 | The VM is libkrun (Wittek, T01; codethief, HN01); "something like firecracker or libkrun" (Cavage, T04); a QEMU module is needed (T11). | Docker wrote its own VMM, "not Firecracker" (srini-docker HN01, B02, B16). Release notes carry `krun_start_enter`, `ffi-krun`, `sailor`, `nerdbox`, `containerd-shim-nerdbox-v1`. | 04:T01 (2026-01-14), 04:T04, 04:T11, 04:HN01 (2026-08-10), 04:B02, 04:B16, 01:S25, 01:S43 | talk vs docs, undocumented | open; capture K00 (`sbx version --json`) and K04 (`uname -a` inside) add names | Print "a VMM Docker wrote, on Hypervisor.framework, WHP, and KVM". Name `sandboxd`, `nerdbox`, and `containerd` only as strings seen in `sbx diagnose` and release assets. Mark libkrun unverified. |
| C5 | The workspace is file synchronization, "not volume mounting", copied both ways. | The workspace is a virtiofs mount at the same absolute path; `DOCKER_SANDBOXES_ENABLE_VIRTIOFS_CACHE` tunes it. | 01:S18 (2026-03-06), 01:S12, 04:T04 (virtiofs), cli:sbx (`create`: "mounted inside the sandbox at the same path") | docs stale | settled by cli:sbx and 01:S12; capture K04 (`mount`) confirms | Bind mount through virtiofs at the same path. Sync-era issues (#40, #62) do not apply. |
| C6 | `--branch` gives the agent a worktree. | `--branch` was removed in v0.31.0 and `--clone` replaced it. v0.47.0 help has `--clone` only. | 01:S35 (2026-05-26), 04:B16, 01:S25 (2026-05-28), cli:sbx | removed, blog stale | settled by cli:sbx | `--clone` only. `--branch` was removed on 2026-05-28. |
| C7 | Export `ANTHROPIC_API_KEY` and friends in `~/.zshrc`, then restart Docker Desktop. | Since v0.35.0 host environment variables are not injected. Use `sbx secret set`, `sbx secret import`, or `sbx setup`. | 01:S18, 01:F68, 01:S25 (2026-07-10), cli:sbx (`secret import`) | removed, docs stale | settled by cli:sbx | Secrets come from the secret store. `-e KEY` passes a plain variable into the sandbox and is not a secret. |
| C8 | Plugin `--pull-template` defaults to `missing`. | `sbx --pull` defaults to `always`. | cli:sandbox, cli:sbx | renamed | settled | Default `always`. `sbx template save` output needs `--pull never -t TAG`. |
| C9 | Agents: plugin v0.12.0 has cagent, claude, codex, copilot, gemini, kiro, opencode, shell. Blogs list five (B09), six incl. `agent` (B10), seven (T11), eight incl. Droid (B16), nine incl. OpenClaw and NanoClaw (B02). | `sbx run` accepts 11 names: claude, codex, copilot, cursor, devin, docker-agent, droid, gemini, kiro, opencode, shell. `sbx create` has 8 subcommands (no copilot, droid, kiro, which are public kits since v0.43.0). `docker-agent` has the alias `cagent`. | cli:sandbox, cli:sbx (`create`, `run`), 01:S25 (v0.43.0 2026-09-15), 04:B02, 04:B09, 04:B10, 04:B16, 04:T11 | docs vs CLI, blog stale | settled by cli:sbx | The manual lists the 11 names from `sbx run --help`, says which 8 have `create` subcommands, and notes `cagent` as an alias of `docker-agent`. |
| C10 | The Docker Agent template is `docker/sandbox-templates:cagent`. | The template is `docker/sandbox-templates:docker-agent`; Hub has `*-0.7.0` tags and no `cagent` tag. | 01:S18, 01:S23 (2026-10-08), 03:S23 | renamed | settled by 01:S23 | `docker/sandbox-templates:docker-agent`. |
| C11 | Product page: `sbx mcp enable github-official --sandbox my-project`. | The CLI has `sbx mcp add`, `ls`, `load`, `rm`, `inspect`, `auth`. No `enable`. | 01:S24 (2026-10-07), cli:sbx (`mcp`) | docs vs CLI | settled by cli:sbx | `sbx mcp add` registers, `--static-mcp` fixes the set at creation, `sbx mcp load` attaches to a running sandbox. |
| C12 | v0.39.0 notes: default kit volume 512 MB. | Kit spec docs: `volumeSize` default 20 GiB. | 01:S25 (2026-08-19), 01:S21 | docs vs repo | open; capture K12 (`sbx kit inspect --json` of a kit with `volume@1`) adds data | Print both numbers with their sources. Do not state one default. |
| C13 | Kits are v1 YAML (blog 2026-08-03), then v2 `spec.yaml` recommended on 2026-09-09, then v3 `kit.yaml` with `# syntax=docker/sandbox-kit:3` from 2026-09-24. Docs now default to v3. | `sbx kit push` and `sbx kit pull` help name only `schemaVersion: "1"` and `"2"`. `sbx kit pack` needs a `spec.yaml`. A v3 kit is an OCI image built with `docker buildx build -f kit.yaml`. | 01:S36, 04:B13, 04:T22, 04:B05, 01:S8, 01:S9, 01:S21, cli:sbx (`kit push`, `kit pull`, `kit pack`) | docs vs CLI, experimental | partly settled; capture K12 (v2 tooling) and K13 (v3 build and `sbx run ./kit`) settle which commands accept which generation | The `sbx kit` artifact commands are v1 and v2 tooling. A v3 kit is built and pushed with Docker tooling and consumed by `sbx run` and `--kit`. The manual says so in Part 4 and shows both. |
| C14 | Linux: Desktop 4.61 "experimental, single user UID 1000, WSL 2"; March 2026 blog: microVMs on macOS and Windows only, Linux on legacy containers. | Docs: Ubuntu 24.04+ with KVM. v0.47.0 ships `.deb` and `.rpm` for amd64 and arm64. Fedora (#84) and Debian (#106) are open issues. | 01:S17, 04:B10 (2026-03-11), 01:S2, 01:S25 (2026-10-05), 01:S26 | blog stale | settled for v0.47.0 by 01:S25 | Linux is supported on Ubuntu 24.04+ with KVM. The manual is captured on macOS and says so. |
| C15 | "You don't need Docker Desktop or Docker Engine to use sbx." | `sbx login` is required before the first sandbox; every `sbx --help` attempted a TLS connection to login.docker.com; issues #5, #167, #321 dispute the login. | 01:S24, 01:S33, 01:S2, 01:S16, cli:sbx-cloud (network note), 01:S26, 04:HN01 | community vs docs | settled: both true | No Docker Desktop. A Docker account sign-in is required. The manual prints the FAQ egress allowlist for the product itself. |
| C16 | Docs, help text, and release notes mention `sbx ssh proxy` (ProxyCommand), `sbx mount` (secret help text), `sbx policy approval`, `--model`, `--provider`, `--usb`. | None of these appears in the v0.47.0 help tree. `sbx policy ls --created-via approval` exists. | 01:S15, 01:S25, 01:gap 15, cli:sbx (`secret set` text names `sbx mount`; `run` flags have no `--model`) | undocumented, experimental | run: capture K02 tries `sbx mount --help`, `sbx ssh --help`, `sbx policy approval --help`, `sbx run --model` after `feature.model` | The manual documents only what `--help` prints and names the hidden commands in one note in 2.5. |
| C17 | Plugin state lived under `~/.docker/sandboxes/vm/<name>/` and `~/.sandboxd/proxy-config.json`. | sbx state lives under `~/Library/Application Support/com.docker.sandboxes/` (macOS) with `~/.sbx/run/` as a symlink. No plugin-to-sbx migration page exists. | 01:S18, 01:S19, 01:S13, 01:S25 (v0.31.0), probe:sbx-daemon-status | undocumented | settled by probe:sbx-daemon-status; capture K34 lists any leftover legacy directories | No state migration exists. Remove legacy directories by hand after Desktop 4.80.0. |
| C18 | `platform.allowExperimentalFeatures` defaults to `false`. | `sbx settings list` shows `true` with SOURCE `default`. | 01:4c (from 01:S12), probe:sbx-settings-list | docs vs CLI | run: capture K02 (`sbx settings get --json platform.allowExperimentalFeatures`) | Print the value and SOURCE column from the capture. |
| C19 | Settings include `feature.model`, `feature.sandbox-gpu`, `feature.udp-egress`, `feature.ssh` (v0.34.0 release note), and `diagnostics.autoUploadErrorCooldownInDays`. | `sbx settings list` prints none of these keys. | 01:S12, 01:S15, 01:S25 (v0.34.0), probe:sbx-settings-list | docs vs CLI | run: capture K02 (`sbx settings get feature.model`) | R.3 prints only keys that `sbx settings list --json` returns, plus a note on documented keys the CLI did not list. |
| C20 | Docs settings table has no `ssh.autoCreate`, `ssh.defaultAgent`, `ssh.defaultTemplate`, `ssh.workspaceRoot`. | `sbx settings list` has all four, with `ssh.defaultAgent` default `shell`. | 01:4c, probe:sbx-settings-list | undocumented | settled by probe | R.3 includes them with the full descriptions from `sbx settings list --json`. |
| C21 | Built-in secret services: anthropic, cursor, droid, github, google, groq, mistral, nebius, openai, openrouter, xai (11). | `sbx secret set` and `sbx secret import` list 13: the 11 plus copilot and devin. | 01:F60 (01:S6), cli:sbx (`secret set`, `secret import`) | docs vs CLI | settled by cli:sbx | 13 services. |
| C22 | `sbx secret set --oauth` stores OAuth tokens. | Locally `--oauth` is "openai/global only"; with `--cloud` it is openai or anthropic. Anthropic OAuth comes from `sbx run claude … -- auth login`, which the proxy captures and reuses, and `secret import` then skips anthropic. | cli:sbx (`secret set`, `secret import`), 04:T02 [05:00] | docs vs CLI | settled by cli:sbx | Two OAuth paths: `--oauth` for openai, the agent's own login for anthropic. |
| C23 | The balanced allowlist is a fixed table in the docs. | The table changes without a changelog: Playwright CDN added in v0.46.0; Andrew Lock's April list had nanoclaw.dev and app.daytona.io. | 01:S5, 01:S25 (2026-09-28), 04:W01 (2026-04-07), 01:gap 20 | docs vs docs | run: capture K03 (`sbx policy init balanced` then `sbx policy ls --wide --json`) | Print the captured list with the version and date. |
| C24 | Sandboxes are capped at 4 GB RAM (issue #36, Desktop 4.61). | `--memory` defaults to 50% of host memory clamped to 512 MiB to 32 GiB; maximum max(75%, 512 MiB). | 01:S26, 01:S25 (v0.25.0), cli:sbx (`create`) | removed | settled by cli:sbx | Print the v0.47.0 rule. |
| C25 | Plugin names allow underscores, periods, plus and minus signs. | sbx names: 2 to 63 characters, start with a letter or digit, letters, digits, hyphens, periods; periods rejected with `--cloud`; `default` reserved. | cli:sandbox, cli:sbx, 01:S25 (v0.43.0) | renamed | settled | Print the sbx rule. |
| C26 | The proxy is `host.docker.internal:3128` (legacy docs, blogs). | Issue #12 says all HTTPS goes through a GoProxy MITM at `gateway.docker.internal:3128`. Current docs name a host-side forward proxy plus a transparent proxy and give no address. | 01:S18, 01:S31, 04:B16, 04:GH-SBX #12 (2026-04), 01:S5 | undocumented | run: capture K04 (`env`, `/etc/hosts`, CA bundle inside) | Print the address and variables the capture shows. |
| C27 | UDP and ICMP are blocked and cannot be allowed (Mikhalev, 2026-05-26). | v0.45.0 added UDP egress behind `feature.udp-egress`; `sbx policy allow network --protocol udp` exists. ICMP stays blocked since v0.33.0 (CVE-2026-12539). | 04:B16, 01:S25 (2026-09-21, 2026-06-17), cli:sbx (`policy allow network`) | blog stale, experimental | settled by cli:sbx | UDP rules exist behind the experimental gate. ICMP is blocked. DNS is policy-gated. |
| C28 | Filesystem policies appear in `sbx policy ls --type filesystem` and in audit. | `sbx policy log --type filesystem`: "filesystem logs are not supported yet". | 01:S11, cli:sbx (`policy log`) | experimental | settled by cli:sbx | Filesystem rules list but do not log in v0.47.0. |
| C29 | Start time "near instantaneously" (T06), "tens to low hundreds of ms" (T04). | "Seconds (after first image pull)" (B20); "I cannot give you any numbers" (Wittek, T01). | 04:T06, 04:T04, 04:B20, 04:T01 | talk vs docs | run: capture K35 (three timed creates on this Mac) | The manual prints its own timing, labelled as one machine, and no vendor number. |
| C30 | Builds inside a sandbox are slow (Andrew Lock; issue #31 Java builds). | A `docker build --no-cache` finished faster inside (1:28.58 vs 1:44.62 on the host). | 04:W01 (2026-04-07), 04:GH-SBX #31, 04:B16 (2026-05-26) | community vs docs | open; K35 optional build timing | Cite both with dates. No performance claim. |
| C31 | `docker sandbox exec -d` runs detached. | `sbx exec -d` is "not supported"; `-d`, `--user`, `--privileged` are rejected with `--cloud`. | cli:sandbox, cli:sbx (`exec`) | removed | settled | Say so in 2.2. |
| C32 | `docker sandbox save` loads the image into the host Docker daemon by default. | `sbx template save` stores it in the sandbox runtime's own image store; `--output` exports a tar; `sbx template load` imports one. | cli:sandbox, cli:sbx (`template`) | renamed | settled | Say so in 2.3 and the migration table. |
| C33 | Gordon has no sandbox integration; it runs on the host. | `sbx reset --help` says it will "Clear the Gordon assistant's sessions and history". | 03:(e)10, cli:sbx (`reset`) | undocumented | run: capture K02 looks for a Gordon entry in `sbx tui` and the state directory | Quote the help line, claim nothing more. |
| C34 | The secret is injected only into headers whose hostname matches the binding (mikesir87). | `inject[].username` is ignored; the secret must be the whole Authorization header (Humphrey). `set-custom --header` and `--format` are cloud-only per help. | 04:HN01 (2026-08-10), cli:sbx (`secret set-custom`) | community vs docs | run: capture K10 (sentinel in, receiver logs out) | Print the captured request on the receiver. For custom secrets print `--header` and `--format` as cloud-only, as the help says. |
| C35 | The sentinel is `proxy-managed`; custom secrets use `sbx-cs-<random>`. | T02 shows `GH_TOKEN` starting `GHO_SBX_PROXY_MANAGED`; help examples show `docker-placeholder-value` and `sk-{rand}`. | 01:S6, 04:T02 [10:30], cli:sbx (`secret rm`, `secret set-custom`) | docs vs CLI | run: capture K10 (`env` inside) | Print the captured values. |
| C36 | Cloud needs sbx 0.45.0+. | Cloud needs sbx 0.45.1+. | 03:S28, 03:S70, 01:S10 | docs vs docs | settled: later number from Docker | Print 0.45.1. |
| C37 | Audit logs need 0.39.0+ and write JSONL under the auditkit directory. | Whether files appear without an AI Governance subscription is not stated. | 01:S11, 01:S25 (v0.32.0) | undocumented | run: capture K32 (`ls` the auditkit directory after K04 to K11) | Print what the directory holds after the runs. |
| C38 | A `--command` secret helper can be a relative path. | Since v0.46.0 command secrets run from a fresh temporary directory; relative helper paths no longer resolve. | pre-v0.46.0 docs, 01:S25 (2026-09-28), cli:sbx (`secret set`) | removed | settled by cli:sbx | Absolute helper paths outside writable mounts. |
| C39 | `-p` binds both IPv4 and IPv6 loopback. | Since v0.42.0 a port published without a protocol binds tcp4; `tcp` explicitly binds both. | 01:S25 (2026-09-07), cli:sbx (`ports`) | removed | settled | Print the tcp4 rule. |
| C40 | Kits load from any registry. | Since v0.34.0 `kit.allowedSources` defaults to `["docker.io/"]`; other sources need a settings change. | 01:S25 (2026-06-26), probe:sbx-settings-list | removed | settled by probe | Capture K13 sets `kit.allowedSources` for `localhost:5000/` and prints the error without it. |
| C41 | Policy rules are global. | v0.29.0 added per-sandbox policies with UUID rule ids; `--sandbox` scopes allow, deny, rm, check; `--deny-network` at create narrows one sandbox. | pre-v0.29.0 docs, 01:S25 (2026-05-13), cli:sbx (`policy`) | removed | settled | Print the two scopes, `global` and `local`. |
| C42 | SSH is `ssh <name>.sbx` via a managed `Host *.sbx` block. | `sbx setup ssh` writes a config plus known_hosts and includes it from `~/.ssh/config`; named app instances use `<name>.sbx-<app>`; no client key, auth is the daemon's Unix socket plus the Docker login. `ssh.autoCreate` can create a sandbox on connect. | 01:S15, cli:sbx (`setup ssh`), probe:sbx-settings-list | docs vs CLI | settled by cli:sbx; capture K02 runs `sbx setup ssh` and prints the written block | Print the help text facts. |
| C43 | Templates and kits are different things with different commands. | A kit can also be the positional agent (`sbx run ./my-kit`, v0.42.0); `--template` is a container image; `--kit` must be a mixin. | 01:S25 (2026-09-07), cli:sbx (`run`, `create`) | docs vs CLI | settled | Define the three words once in 2.1 and keep them apart. |
| C44 | The `sbx` TUI is the dashboard. | `sbx` with no command opens interactive mode; `sbx tui` opens the dashboard explicitly. | cli:sbx (root, `tui`), 04:T02 [09:00] | undocumented | settled | Mention both entry points. |
| C45 | The guest uses 16K pages (Mikhalev). | `sbx diagnose` prints "guest kernel page size 16384 bytes" and mkfs.erofs block size 4096. | 04:B16, probe:sbx-diagnose | community vs docs | settled by probe | Print the diagnose line. |
| C46 | `sbx kit ls` exists. | `sbx kit ls` is "unknown command"; `sbx kit validate` exists and is absent from the research command table. | 01:4a, probe:sbx-kit-ls, cli:sbx (`kit`) | docs vs CLI | settled by probe | R.1 lists `add, builder, inspect, pack, provenance, pull, push, sign, validate, verify`. |
| C47 | `sbx --cloud` supports the same verbs as local. | `sbx --cloud --help` hides `daemon`, `prune`, `settings`, `skills`; `volume` and `attach` and `ttl` are cloud-only; `rm --all` is disabled with `--cloud`. | cli:sbx-cloud, cli:sbx (`rm`, `volume`, `attach`, `ttl`) | docs vs CLI | settled | R.1 marks each verb local, cloud, or both. |
| C113 | The frontend sets four `vnd.docker.sandbox.kit.*` annotations and promotes all four onto the image index whenever the export produces one. A single-platform build with an attestation manifest counts. | The recorded index holds one image manifest and one attestation manifest, and it has no annotations. The four kit annotations and four derived `org.opencontainers.image.*` keys sit on the arm64 image manifest. | kitspec §9.3 (tag v3.0.0-m.8, 2026-10-02), `28-index.json`, `28-manifest.json`, `28-buildx.txt` | docs vs CLI | settled by `28-index.json` | 4.1 prints both sides. Index annotations are an optimization in the spec, so a consumer reads the platform manifest when the index has none (kitspec §9.3). |
| C114 | The README of the kit specification says the floating `docker/sandbox-kit:3` moves only when a stable `3.X.Y` is released, never for a milestone. | The recorded builds resolved `docker/sandbox-kit:3` to sandbox-kit 3.0.0-m.8, a milestone, and `built-by` in the manifest names version `3.0.0-m.8`. | `kit-spec-extras.md` (README, The frontend image, main `4be7f4dff4d6`, fetched 2026-10-08), `28-buildx.txt`, `28-buildx-docker-driver.txt`, `28-manifest.json` | docs vs CLI | settled by `28-buildx.txt` | 4.1 prints both sides. A build that must resolve the same frontend every time names the exact version tag, as the README says. |
| C115 | The docs publish a v3 kit with `docker buildx build ./my-kit -f ./my-kit/my-kit.yaml -t docker.io/<NAMESPACE>/my-kit:1.0.0 --push` and name no builder. | With the default `docker` driver of Desktop 4.94.0, the same command form pushed a Docker schema 2 manifest with no annotations. A `docker-container` builder pushed an OCI index whose platform manifest kept them. | docs-sbx Build and distribute kits, Publish an image (fetched 2026-10-08), `28-buildx-docker-driver.txt`, `28-manifest-docker-driver.json`, `28-buildx.txt`, `28-manifest.json` | docs vs CLI | settled by `28-manifest-docker-driver.json` | 4.1 says to build with a `docker-container` builder. An image without the descriptor annotation is not a kit to a consumer (kitspec §10). |
| C116 | The docs say that during development you can pass a local source directory to `sbx` instead of a pushed image. | On Desktop 4.94.0, `sbx kit inspect` of the local source directory failed with "OCI exporter is not supported for the docker driver". `sbx kit validate` and `sbx kit pack` also refused it. | docs-sbx Build and distribute kits, Publish an image (fetched 2026-10-08), docs-sbx Build an agent workload, Build and use the kit, `13-kit-v3-inspect.txt`, `28-kit-inspect-source.txt`, `13-kit-v3-validate.txt`, `13-kit-v3-pack.txt` | docs vs CLI | settled for `sbx kit inspect` by `13-kit-v3-inspect.txt`. No capture ran `sbx run` or `sbx create` on the directory | 4.1 prints both sides and claims nothing about `sbx run` on a directory. The error names the `docker` driver and a containerd image store as the way out. |
| C117 | The help of `sbx kit builder` says source-form kit builds, from a local directory or a git reference, run inside a shared builder sandbox named `sbx-kit-builder`, created on first use. | The recorded source build ran through the host Docker daemon and failed on its `docker` driver. The builder status taken after it still reads "not created". | help-sbx sbx kit builder, `13-kit-v3-inspect.txt`, `13-kit-builder-status.txt` | docs vs CLI | settled by `13-kit-builder-status.txt` | 4.1 and 4.3 quote the help and print the status. The manual says the recorded build used the host daemon. It does not say where a successful source build runs. |

## Group B: docker-agent (the runtime, the CLI, the agent file)

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C48 | The installed `docker agent` plugin is v1.32.4 (2026-03-16). | The installed `docker-agent` binary is v1.149.0 ("Commit: Homebrew"); Desktop 4.94.0 bundles v1.144.0. | cli:agent, probe:docker-agent-version, 02:S10 | docs vs CLI | settled by probe | The manual pins v1.149.0 from Homebrew. The `docker agent` plugin version follows Desktop; capture K34 prints both. |
| C49 | "Docker Agent" arrived in Docker Desktop 4.63 (2026-03-02); 4.49 to 4.62 called it cagent. | The 4.63.0 notes say nothing; the first note that names Docker Agent is 4.64.0 (2026-03-11, v1.27.1); the v1.30.0 rename shipped 2026-03-09. | 02:S1, 02:S8, 02:S10, 02:S14 | docs vs docs | open | Print "4.63 per the docs; first release note naming it 4.64.0". |
| C50 | Each Desktop release bundles a stated Docker Agent version. | Releases 4.50 to 4.54, 4.57 to 4.63, 4.66, 4.75, 4.80, 4.85 state none; v1.32.4 matches no listed bundle. | 02:S10, 02:S11 | undocumented | open | Footnote in 7.3. |
| C51 | Commands are `cagent run`, `cagent push`, `cagent acp`, `cagent new`, `brew install cagent`, `cagent.yaml`; later `docker sandbox run agent`, `agent run dev-team.yaml`, docs at `/ai/cagent/`. | Commands are `docker agent run`, `share push`, `serve acp`, `new`; `brew install docker-agent`; `sbx run docker-agent`; docs at `/ai/docker-agent/`. | 02:S20 (2025-09-18), 02:S21, 02:S22, 02:S25 (2026-03-11), 02:S2, cli:da | renamed, blog stale | settled by cli:da | Migration table rows S5 to S9. |
| C52 | `cagent config`, `cagent feedback`, `cagent build`, `cagent catalog`, `cagent exec` exist; `pull` and `push` are top level; `a2a`, `acp`, `mcp`, `api` are top level. | v1.23.4 (2026-02-19) removed the first four, replaced `exec` with `run --exec`, moved pull and push under `share`, and moved the four servers under `serve`. | 02:S14 | removed | settled | Migration table rows S6 and S7. |
| C53 | Environment variables are `CAGENT_*`. | v1.30.0 renamed them `DOCKER_AGENT_*`; old names still accepted. `TELEMETRY_ENABLED` has no prefix. `CAGENT_PPROF_ADDR` still appears in one docs page. | 02:S14, 02:S8, 03:S55 | renamed | settled | R.3 lists the `DOCKER_AGENT_*` names and the legacy aliases. |
| C54 | The rename touched everything. | The directories are still `~/.cagent` (data), `~/.config/cagent` (config, `.env`, `hooks.d`), `~/Library/Caches/cagent` (cache). | cli:da (global flags), 02:S3 | renamed | settled by cli:da | Print the paths as they are. |
| C55 | "Docker Agent v2.x" renamed the CLI (DigitalOcean). | No v2 tag exists; latest is v1.149.0. | 02:S28, 02:S17 | blog stale | settled | Row S19 in stale advice. |
| C56 | `handoff` and `transfer_task` are toolset types (examples/README; the docs built-in table has rows for them). | The schema `type` enum has 27 values and excludes them; `docker-agent toolsets` prints 27 types without them. They are injected by `sub_agents` and `handoffs`. | 02:S15, 02:S5, 02:S13, probe:docker-agent-toolsets | docs vs repo | settled by probe | 5.4 says "not a type". R.5 lists them in a separate row marked implicit. |
| C57 | `examples/deferred.yaml` wraps the agent in `runtime: deferred`. | The file uses `defer` on `filesystem` and `shell` toolsets. | 02:S15, 02:S3 | docs vs repo | open (file not read in full) | Cite the docs page, not the README line. |
| C58 | Provider ids are `fireworks`, `together`, `moonshot`, `opencode-zen`. | Canonical ids are `fireworks-ai`, `togetherai`, `moonshotai`, `opencode` (v1.149.0); `docker-agent doctor` prints the canonical names; legacy ids stay as aliases. | 02:S4, 02:S14, probe:docker-agent-doctor | renamed | settled by probe | R.6 prints canonical ids with the alias column. |
| C59 | `--yolo` is the way to approve everything. | `--yolo` is "same as `--safety autonomous`"; four modes exist. The GitHub Action still exposes `yolo` (default true) and `sbx run docker-agent` runs `docker-agent run --yolo`. | cli:da (`run`), 02:S19, 02:S9 | renamed | settled by cli:da | Print `--safety autonomous`, name `--yolo` as its alias, and show where `--yolo` is still the default. |
| C60 | `--sandbox` "requires Docker Desktop with sandbox support"; `--template` is passed to `docker sandbox create -t`. | `--sbx` defaults to true; `--sbx=false` forces `docker sandbox`, which Desktop 4.80.0 removed. | cli:agent, cli:da (`run`), 01:S17 | docs vs CLI | settled | `--sbx=false` has no working target on Desktop 4.80.0 or later. |
| C61 | `docker-agent run --sandbox` uses `docker/docker-agent-sbx-templates:latest`. | `sbx run docker-agent` uses `docker/sandbox-templates:docker-agent`. | cli:da (`run --template`), 03:S9, 03:S55 | docs vs docs | settled: two images for two launch paths | 1.2 draws both paths with both image names. |
| C62 | Inside `--sandbox` the agent runs with `--yolo` unless `--safety` is given. | The exact default inside the VM (`autonomous` or `restricted`) was cut from the docs capture. | 02:open q 10, 03:S33 | undocumented | open. Capture K30 did not print a mode | The mode stays unknown in this edition. The `--sandbox` run stopped at "attempt to write a readonly database (1032)" before it printed a mode (`27-sandbox-run.txt`). A Python `sqlite3` write on the same mount fails the same way (`27-sqlite-probe.txt`). The in-VM `--exec` run answered without naming a mode (`27-inside-run.txt`). The manual prints no mode. |
| C63 | The session database is `<data-dir>/session.db`. | `serve api` defaults to `session.db` in the current directory. | cli:da (`run`, `serve a2a`, `serve acp`, `sessions diff` vs `serve api`) | docs vs CLI | settled by cli:da | 5.6 and 6.1 print both defaults. |
| C64 | `serve a2a -a` defaults to `root`. | v1.149.0: "defaults to the team's first agent". | cli:agent, cli:da | renamed | settled | Print the v1.149.0 text. |
| C65 | `eval -c` defaults to the number of CPUs; the judge is `anthropic/claude-opus-4-5-20251101`. | v1.149.0 help: `-c` default 10, judge `openai/gpt-5.6-terra`, `--judge-type llm\|evaluator` with `typesafe/jev-latest` for evaluator. | 02:S2, 02:S6, cli:agent, cli:da (`eval`) | docs vs CLI | settled by cli:da | Print 10 and `openai/gpt-5.6-terra`; the capture uses `--judge-model dmr/ai/qwen3`. |
| C66 | `docker agent new --model` accepts 30+ providers. | The flag help names "anthropic, openai, google, dmr, or a custom provider from docker agent setup". | 02:S4, cli:da (`new`) | docs vs CLI | settled by cli:da | `new` auto-selects among those; `run --model` takes any provider in R.6. |
| C67 | Telemetry is disabled by a `DOCKER_AGENT_*` variable. | `TELEMETRY_ENABLED=false` disables it; `DOCKER_AGENT_HIDE_TELEMETRY_BANNER` hides the notice only. | 02:S8, 02:S14 | docs vs repo | settled | R.3 prints both. |
| C68 | A CLI reference lives at `/reference/cli/docker/agent/`. | That path is 404; the reference is `/ai/docker-agent/features/cli/` and `--help`. | 02:S2, 03:(g)1 | undocumented | settled | Cite the features page and the help tree. |
| C69 | The hooks "Available built-ins" table lists N built-ins. | The research capture truncated after `add_git_status`; confirmed names are `add_context`, `add_date`, `add_environment_info`, `add_prompt_files`, `add_git_status`, `redact_secrets`, `unload`, `transform_json`. | 02:S3, 02:gap 17 | undocumented | open (docs page not re-read) | 5.5 names only the confirmed built-ins. |
| C70 | `serve a2a` exposes an agent over A2A. | "Current Limitations": tool calls are not A2A events, no artifacts, no memory, multi-agent "needs further work". | 02:S6 | docs vs docs | run: capture K26 (card plus `SendMessage` plus `GetTask`) | 6.4 prints the captured card and names each limitation that the capture shows. |
| C71 | The A2A agent card is at `/.well-known/agent-card.json` (A2A 1.0). | The path and the protocol version `serve a2a` speaks are not stated in the Docker Agent docs. | 02:open q 6, a2a-101 spec §8.2 | undocumented | run: capture K26 tries `/.well-known/agent-card.json` then `/.well-known/agent.json` | Print the path that answered and the `protocolVersion` field. |
| C72 | `docker ai` is Gordon, a separate product. | Release notes show `docker ai` shells out to Docker Agent; the invocation is undocumented. | 03:S41, 03:(e)8 | undocumented | open | One sentence in 1.1; nothing more. |
| C73 | `ref: docker:<name>` runs catalog servers "via the MCP Gateway". | Whether it needs Desktop's MCP Toolkit or works with a standalone `docker-mcp` plugin without a daemon is not stated. | 02:S5, 03:S34, 02:open q 7 | undocumented | run: capture K29 with Desktop running, then with the daemon stopped | Print both outcomes. |
| C74 | The project is "almost two years old" (HN). | The oldest visible commit is 2025-07-31; the public repo was created 2025-09-01. | 04:HN01, 02:S16, 02:S27 | community vs docs | settled | Print the dates. |
| C75 | `docker agent` with no arguments runs `run`. | v1.149.0 root help lists `getting-started` first; the walker did not capture its help. | 02:S2, cli:da (root) | undocumented | run: capture K01 (`docker-agent getting-started --help`) | Print what it does from its help. |
| C76 | A2A, ACP, MCP, API servers forward budgets. | "ACP, MCP, and A2A servers do not forward manifest wallets." | 02:S3 budget, 02:S6 | docs vs docs | settled by the budget page | 6.3 and 6.4 say budgets do not apply to served agents. |
| C118 | The docs say the current agent file config version is `15`. | The schema `version` enum runs from `"0"` to `"16"`. The captured agent files declare `"16"` and load. | docs-agent Configuration Overview, Config Versioning (fetched 2026-10-08), schema version (tag v1.149.0), `18-run-exec.txt`, `20-restricted.txt` | docs vs repo | settled by schema version | 5.2 and R.4 print `"16"` from the schema and say the docs page still names `15`. |
| C119 | The docs say Docker Agent generates a short title for each session from the first message. | The five newest sessions in `session.db`, all `--exec` runs, are titled `Running agent`. | docs-agent Sessions, Session Titles (fetched 2026-10-08), `21-session-db.txt` | docs vs CLI | settled by `21-session-db.txt` | 5.6 prints the five rows and does not claim a title made from the first message. |
| C120 | A2A 1.0.1 requires every skill to carry a `name`, and requires `defaultInputModes` and `defaultOutputModes` to hold at least one element each. | The card of `serve a2a` has `"name": ""` on its one skill and two empty mode lists. | manuals/a2a-101/sections/2-1-agentcard-fields.md (spec §5.7), `23-agent-card.json`, `23-a2a.http` | docs vs CLI | settled by `23-agent-card.json` | 6.3 prints the card against the rules and marks each difference. A client that calls `serve a2a` has to accept an empty skill name and empty mode lists. |
| C121 | The docs list "A2A artifact support not yet integrated" among the current limitations of `serve a2a`. | `SendMessage` returned a completed task whose artifacts hold the answer `pong`, and `GetTask` returned the same artifacts. | docs-agent A2A Protocol, Current Limitations (fetched 2026-10-08), `23-a2a.http` | docs vs CLI | settled by `23-a2a.http`, the capture outcome of C70 for artifacts | 6.3 says the capture contradicts that limitation. The three other limitations stay untested, because the pong agent has no tool calls, memory, or sub-agents. |

## Group C: Docker Model Runner

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C77 | `docker model configure --context-size 8192 MODEL` sets the context. | `configure` is absent from the CLI reference index, from local `docker model` v1.1.5, and `/reference/cli/docker/model/configure` is 404; the guide packages a variant with `docker model package --from … --context-size`. | 03:S11, 03:S14, 03:S15, 03:S43, 03:S50, 03:S36 | docs vs CLI | run: capture K28 (`docker model configure --help` after the Desktop update) | Print whichever exists; Docker Agent sets `provider_opts.context_size` through `_configure`. |
| C78 | `--gpu` accepts `cuda, rocm, vulkan, metal`. | The CLI accepts `none\|auto\|cuda\|rocm\|musa\|cann`. | 03:S15, 03:S50 | docs vs CLI | settled by CLI | Print the CLI list. |
| C79 | The Anthropic-compatible path is `/anthropic/v1/messages`. | The same page's examples and the sandbox guide call `/v1/messages`. | 03:S13, 03:S36 | docs vs docs | run: capture K28 curls both | Print the one that answered 200. |
| C80 | vLLM is Linux x86_64 and Windows WSL2 only. | Desktop 4.62 added "vLLM Metal"; status lists `mlx`, `sglang`, `vllm-metal`. | 03:S15, 03:S41 | docs vs docs | open | The manual uses llama.cpp only and says so. |
| C81 | The local `docker model` plugin is v1.1.5. | docker/model-runner is v1.2.8; Desktop 4.88 bundles 1.2.8; Desktop 4.94.0 is current. | 03:S50, 03:S61, 03:S41 | docs vs CLI | run: capture K00 after the Desktop update | Pin DMR to the version `docker model version` prints after the update. |
| C82 | DMR is on by default. | Since Desktop 4.71.0 DMR is disabled by default; host TCP activates when enabled; `docker desktop enable model-runner --tcp 12434`. | 03:S41 (2026-04-27), 03:S13 | removed | settled | Capture K28 starts with the enable step. |
| C83 | `provider_opts.context_size` is applied. | Issue #4522: an integer value is ignored (uint64 decode). | 03:S32, 02:S16 | undocumented | run: capture K28 sends it and watches `docker model requests -f` | Print the request body the runner received. |
| C84 | DMR needs no key and ignores `Authorization`. | The API "is not authenticated" and any container on the same network can reach it. | 03:S11, 03:S13 | docs vs docs | settled: same fact | 6.6 says so. |
| C85 | Release notes link DMR 1.2.8 to `docker/model-cli`. | That repository is archived; the source is `docker/model-runner`. | 03:S41, 03:conflict 10 | docs stale | settled | Cite `docker/model-runner`. |

## Group D: MCP gateway and MCP Toolkit

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C86 | `docker mcp` has `profile` and `oauth` subcommands (Desktop 4.62+). | Local v0.40.1 has neither and still has `catalog bootstrap\|fork\|import\|init\|reset\|update`; the repo's latest is v0.44.1 (prerelease). | 03:S4, 03:S42, 03:S50, 03:S60 | docs vs CLI | run: capture K00 and K29 after the Desktop update | Pin to the version `docker mcp version` prints after the update. |
| C87 | The catalog has "300+ verified servers". | The Gateway tip and the E2B page say "200+". | 03:S1, 03:S3, 03:S5, 03:S8 | docs vs docs | settled: print "more than 200" | Print "more than 200, 300 on the index page". |
| C88 | The MCP Gateway is "invite-only" under Docker AI Governance. | The gateway is open source (MIT), bundled in Desktop, and runnable standalone. | 03:S1, 03:S5, 03:S51 | docs vs repo | settled: two things share a name | 6.6 separates the hosted governed gateway from the `docker-mcp` plugin. |
| C89 | `--verify-signatures` has no default in the docs reference. | The repo-generated reference shows default `true`. | 03:S42, 03:S51 | docs vs repo | run: capture K29 (`docker mcp gateway run --help`) | Print the default from the help. |
| C90 | `https://registry.modelcontextprotocol.io/...` references are a supported server source. | The repo's profiles doc: "MCP Registry references are not fully implemented". | 03:S4, 03:S51 | docs vs repo | open | 6.6 marks registry references as partly implemented in the Toolkit; `sbx mcp add --url` accepts them (cli:sbx). |
| C91 | One MCP gateway serves everything. | The Sandboxes gateway "is separate from the Docker Desktop MCP Toolkit"; settings are not shared; the Docker Agent sandbox template copies `docker-mcp` from `docker/mcp-gateway:v2`. | 03:S24, 03:S55 | docs vs docs | settled | The manual names three: the sbx host-side gateway, the Toolkit gateway (`docker mcp gateway run`), and the hosted gateway. |
| C92 | Desktop bundles a known mcp-gateway version. | The last stated bundle is 0.42.2 in Desktop 4.77; the `:v2` tag meaning is unstated. | 03:S41, 03:open q 9, 03:open q 10 | undocumented | run: capture K29 (`docker mcp version`; `docker run --rm docker/mcp-gateway:v2 --version`) | Print both outputs. |
| C93 | The GitHub Action installs mcp-gateway v0.22.0 by default. | The repo is at v0.44.1. | 02:S19, 03:S60 | docs stale | settled | One sentence in 7.3. |

## Group E: Compose

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C94 | `models` needs Compose 2.38.0+. | The demos README says Desktop 4.43.0+ or Compose 2.38.1+; the latest Compose is v5.6.0. | 03:S16, 03:S54, 03:S64 | docs vs repo | settled | Pin Compose v5.6.0 and print the 2.38 floor. |
| C95 | Compose with `models:` works inside a sandbox's private engine. | Nothing documents DMR inside the VM. | 03:gap 18, 03:open q 4 | undocumented | run: capture K31 tries `docker compose up` with `models:` inside a shell sandbox | Print the outcome. |
| C96 | Compose can start sandboxes. | No such feature exists (asked on 2026-04-07, unanswered). | 04:T05 [45:00] | community vs docs | settled | One sentence in 6.6. |
| C97 | The compose-for-agents demos run as published. | Samples rot: Agno removed upstream (#122), ADK needs `--allow-unauthenticated` (#162), a2a-sdk breaking change (#131). | 04:GH-CFA | community vs docs | settled | The manual uses its own `compose.yaml`, not the demos. |

## Group F: Offload

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C98 | Offload: 300 free GPU minutes, then $0.015 per GPU minute (2025 beta). | 2026: "Predictable pricing", a Docker Business add-on sold through sales, no published price. | 04:T13, 03:S77, 03:S20, 03:S78, 04:B24 | blog stale | settled: no public price today | Offload is out of scope; one paragraph in 7.1 says why. |
| C99 | Offload is the cloud path for sandboxes. | Offload is a remote Docker daemon over SSH for Desktop; the sandbox cloud path is `sbx --cloud` on the Agentic Platform; nothing links the two. | 03:S20, 03:S28, 03:(d)8 | docs vs docs | settled | Say so in 7.1. |
| C100 | Offload runs production workloads. | "Offload is not intended to run your workloads for production" (Irwin, 2025-07-30). | 04:T13 [37:00] | talk vs docs | settled | Omit; out of scope. |

## Group G: Cloud Sandboxes and the Agentic Platform

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C101 | Prices are documented. | Prices live in the launch blog and in `sbx template load --help` (shapes only); the docs tree has none. The $250 credit is promotional. | 03:S70 (2026-09-24), cli:sbx (`template load`), 01:gap 21 | docs vs docs | settled | 7.1 prints shapes from the help and prices from the blog with its date, and marks the credit as promotional. |
| C102 | Six cloud kits at launch: Claude Code, Codex, Copilot, Antigravity, OpenCode, Hermes. | The SDK bundles eight: shell, claude, codex, cursor, devin, docker-agent, gemini, opencode. | 04:B04, 03:S29 | docs vs docs | open | Print both lists with their sources. |
| C103 | Pay-as-you-go needs a personal Docker account. | The blog says Personal and Pro; Team and Business are not stated. | 03:S30, 03:S70 | docs vs docs | open | Print "Personal or Pro"; mark the rest unverified. |
| C104 | `docker exec` and healthchecks work in cloud sandboxes. | They "can access the sandbox VM filesystem instead of the target container's", so `service_healthy` can block. | 03:S28, 01:S10 | docs vs docs | run: capture K33 (money) | Print as a documented limitation; confirm if K33 runs. |
| C105 | Warp Oz launches agents into Docker-provided cloud sandboxes. | Not confirmed in any doc. | 04:T17 | talk vs docs | open | Omit. |
| C106 | AI Governance runs the sandbox primitive "inside Kubernetes". | No other source mentions a Kubernetes runtime. | 04:B15 | blog stale | open | Omit. |

## Group H: legacy plugins (`docker sandbox` v0.12.0, `docker agent` v1.32.4, `cagent`)

| id | Source A says | Source B says | Sources (ids, dates) | Kind | Status today | Ruling the manual prints |
|---|---|---|---|---|---|---|
| C107 | `docker sandbox` still ships in Desktop as a subset of sbx (May 2026); the new experience is "coming" to Desktop (March 2026). | Desktop 4.80.0 (2026-06-29) removed the plugin. | 04:T11, 04:B03, 01:S17 | removed | run: capture K34 (`docker sandbox version` on Desktop 4.94.0) | Print the error text the capture shows. |
| C108 | `--mount-docker-socket` (Desktop 4.50), `--load-local-template` (4.58 to 4.60), `--pull-template` (4.61) are the flags. | None exists in sbx; `--pull` replaces `--pull-template`; the private engine replaces the socket mount. | 01:S29, 01:S18, cli:sandbox, cli:sbx | removed | settled | Migration rows S1 to S4. |
| C109 | Network control is `docker sandbox network proxy --policy allow\|deny --allow-host --block-host --bypass-host --allow-cidr --block-cidr --bypass-cidr` and `network log`. | sbx has `policy init\|allow\|deny\|rm\|ls\|inspect\|check\|log\|reset`; no bypass flag appears in the v0.47.0 help. | cli:sandbox, cli:sbx | renamed | settled; bypass equivalent is run: capture K09 searches `sbx policy --help` text | Migration rows S10 and S11; bypass "no replacement found in the v0.47.0 help". |
| C110 | Default allowed hosts were `*.anthropic.com` and `platform.claude.com:443`; Desktop 4.60 blocked console.anthropic.com and claude.ai; blocked CIDRs were the RFC 1918 ranges. | sbx presets are allow-all, balanced, deny-all; the balanced list is captured in K03. | 01:S18, 01:S17 (2026-02-09), cli:sbx (`policy init`) | removed | settled | Legacy list appears only in 7.3. |
| C111 | `cagent` is a binary in Desktop; verify with `cagent version`. | Desktop 4.81.0 (2026-07-06) removed the `cagent` binary; the `docker/docker-agent` image keeps a `cagent` symlink. | 02:S22, 02:S10, 02:S14 | removed | settled | Migration row S8. |
| C112 | The legacy plugin reads API keys from the daemon environment and stores agent state under `~/.docker/sandboxes/vm/<name>/`. | sbx reads nothing from the daemon environment and keeps state under `com.docker.sandboxes`. | 01:S18, 01:S13 | removed | settled | One table in 7.3. |
| C122 | The Desktop 4.80.0 release note (2026-06-29) says the experimental `docker sandbox` plugin has been removed and says to migrate to `docker sbx`. | On Desktop 4.94.0, `docker sandbox --help` prints a removal notice that points to the Docker Sandboxes product page, and it exits 1. The plugin list still shows `sandbox v0.13.0`. | docs-desktop 4.80.0, Bug fixes and enhancements (fetched 2026-10-08), `29-docker-sandbox.txt`, `29-docker-plugins.txt` | docs vs CLI | settled by `29-docker-sandbox.txt` | 7.3 prints the notice and says it names the product page, not `docker sbx` (C1). The plugin entry stays in the list, and the command only prints the notice. |

## Group I: stale advice in the wild (the migration section prints this list)

Each row is one piece of advice a reader can find in a blog, a video, or an old doc, the date it stopped being true, and what to do now. Rows S1 to S30.

| id | The advice as printed | Where it appears | Stopped being true | Do this instead | Sources |
|---|---|---|---|---|---|
| S1 | `docker sandbox run <agent>` | Desktop docs, blogs, videos | Desktop 4.80.0, 2026-06-29 | `sbx run <agent>` | 01:S17, cli:sandbox, cli:sbx |
| S2 | `docker sandbox run --mount-docker-socket kiro` | re:Invent blog 2025-12-12 | Desktop 4.58.0 (microVM), 2026-01-26 | Every sandbox has a private Docker Engine; no socket mount exists | 01:S29, 01:S17 |
| S3 | `--load-local-template` | Desktop 4.58 to 4.60 | Desktop 4.61, 2026-02-18 | `sbx template load FILE` then `--pull never -t TAG` | 01:S18, cli:sbx |
| S4 | `--pull-template missing` | plugin v0.12.0 | v0.21.0, 2026-03-31 | `--pull always\|missing\|never`, default `always` | cli:sandbox, cli:sbx |
| S5 | `docker sandbox create cagent .` | plugin v0.12.0, March 2026 Captains blog | Desktop 4.80.0 | `sbx create docker-agent .` (`cagent` is still an alias of the subcommand) | cli:sandbox, cli:sbx, 02:S25 |
| S6 | `cagent run agent.yaml`, `cagent new`, `cagent exec` | 2025 blogs and talks | v1.23.4, 2026-02-19, and Desktop 4.81.0 | `docker agent run`, `docker agent new`, `docker agent run --exec` | 02:S14, 02:S20, cli:da |
| S7 | `cagent push org/agent`, `cagent pull`, `cagent acp`, `cagent api`, `cagent mcp`, `cagent a2a` | 2025 blogs, 2025-11-13 ACP post | v1.23.4 | `docker agent share push\|pull`, `docker agent serve acp\|api\|mcp\|a2a` | 02:S14, 02:S22 |
| S8 | `cagent version` to check the bundled binary; `brew install cagent` | 2025-11-13 blog | v1.30.0 (2026-03-09) and Desktop 4.81.0 | `docker agent version`; `brew install docker-agent`; `winget install Docker.Agent` | 02:S22, 02:S14, 02:S12 |
| S9 | `cagent config`, `cagent feedback`, `cagent build`, `cagent catalog` | 2025 to early 2026 | v1.23.4 | Removed. The catalog is a Docker Hub namespace (`agentcatalog/*`). | 02:S14, 02:S18 |
| S10 | `docker sandbox network proxy S --allow-host api.example.com` | legacy docs, OpenClaw blog 2026-02-23 | Desktop 4.80.0 | `sbx policy allow network api.example.com [--sandbox S]` | cli:sandbox, cli:sbx, 04:B21 |
| S11 | `docker sandbox network log --json` | legacy docs | Desktop 4.80.0 | `sbx policy log [S] --json` | cli:sandbox, cli:sbx |
| S12 | `docker sandbox save S TAG` loads into host Docker | plugin v0.12.0, OpenClaw blog | Desktop 4.80.0 | `sbx template save S TAG [-o FILE]` into the sandbox runtime's store | cli:sandbox, cli:sbx |
| S13 | Set the proxy by hand at `host.docker.internal:3128`; add a Node bridge on 127.0.0.1:54321 | OpenClaw blog 2026-02-23, Mikhalev 2026-05-26 | sbx (the proxy is configured by the daemon) | Do nothing; capture K04 prints what the sandbox sees | 04:B21, 04:B16 |
| S14 | Export API keys in `~/.zshrc` and restart Docker Desktop | legacy agent pages, pre-July tutorials | v0.35.0, 2026-07-10 | `sbx secret set SERVICE` or `sbx secret import` | 01:S18, 01:S25 |
| S15 | `sbx run claude --branch` | Mikhalev 2026-05-26, videos | v0.31.0, 2026-05-28 | `sbx run claude --clone` | 01:S35, 01:S25 |
| S16 | Kit v1 grammar: `schemaVersion: "1"`, `commands: install:`, `network.allowedDomains`, `credentials.sources` | "Empty sandboxes" blog 2026-08-03 | v2 recommended 2026-09-09; v3 published 2026-09-24 | v2 `spec.yaml` for `sbx kit` artifacts; v3 `kit.yaml` with `# syntax=docker/sandbox-kit:3` for OCI kits | 04:B13, 04:T22, 04:B05 |
| S17 | `sbx mcp catalog` | docs before v0.45.0 | v0.45.0, 2026-09-21 | `sbx mcp add --url <registry or manifest URL>` | 01:S25, cli:sbx |
| S18 | `sbx mcp enable github-official --sandbox my-project` | product page 2026-10-07 | never existed in a help tree | `sbx mcp add` then `--static-mcp` or `sbx mcp load` | 01:S24, cli:sbx |
| S19 | "Docker Agent v2.x renamed the CLI" | DigitalOcean tutorial | never true | The latest is v1.149.0 | 02:S28, 02:S17 |
| S20 | `docs.docker.com/ai/cagent/` | March 2026 blog, older links | redirects since the v1.30.0 rename | `docs.docker.com/ai/docker-agent/` | 02:S1, 02:S25 |
| S21 | `CAGENT_MODELS_GATEWAY`, `CAGENT_CONFIG_DIR`, `CAGENT_PPROF_ADDR` | older docs and issues | v1.30.0 (still accepted) | `DOCKER_AGENT_MODELS_GATEWAY`, `DOCKER_AGENT_CONFIG_DIR`, `DOCKER_AGENT_PPROF_ADDR` | 02:S14, 03:S55 |
| S22 | `docker/sandbox-templates:cagent` | legacy agent page | the rename | `docker/sandbox-templates:docker-agent` | 01:S18, 01:S23 |
| S23 | A `--command` secret helper written as `./helper` or `cat token` | pre-v0.46.0 docs | v0.46.0, 2026-09-28 | An absolute path outside writable sandbox mounts | cli:sbx, 01:S25 |
| S24 | `-p 3000:8080` binds IPv4 and IPv6 | pre-v0.42.0 | v0.42.0, 2026-09-07 | Default is tcp4; write `3000:8080/tcp` for both | cli:sbx, 01:S25 |
| S25 | Kits can be pulled from any registry | pre-v0.34.0 | v0.34.0, 2026-06-26 | Add the prefix to `kit.allowedSources` | 01:S25, probe:sbx-settings-list |
| S26 | `docker cp /usr/bin/agent sandbox:/…`, `agent run dev-team.yaml` inside a sandbox | Captains blog 2026-03-11 | sbx and the `docker-agent` template | `sbx run docker-agent .` or `docker agent run --sandbox agent.yaml` | 02:S25, 03:S9, cli:da |
| S27 | "Docker enforces one sandbox per workspace" | Captains blog 2026-03-11 | sbx names default to `<agent>-<workdir>`, so two agents on one directory are two sandboxes (T21) | Name sandboxes with `--name`; capture K04 creates two on one directory | 04:B10, 04:T21, cli:sbx |
| S28 | Windows 10 is supported | early 2026 | v0.35.0, 2026-07-10 | Windows 11 with Windows Hypervisor Platform | 01:S25, 01:S2 |
| S29 | MCP Toolkit gateway for a sandbox: `--transport=streaming` at `host.docker.internal:8811`, five manual steps | re:Invent blog 2025-12-12, mcp-gateway #501 | v0.38.0, 2026-08-06 | `sbx mcp add` and `sbx mcp load`; the Toolkit gateway is separate | 04:B23, 04:GH-GW #501, 01:S25 |
| S30 | The judge model for `eval` is a paid Anthropic model | v1.32.4 help | v1.147.0, 2026-10-05 | Default `openai/gpt-5.6-terra`; any `provider/model` works, the capture uses `dmr/ai/qwen3` | cli:agent, cli:da, 02:S14 |

## Rows that need a run, by capture id

| Capture | Rows it settles or informs |
|---|---|
| K00 | C4, C81, C86 |
| K01 | C75 |
| K02 | C16, C18, C19, C33, C42 |
| K03 | C23 |
| K04 | C4, C5, C26, S13, S27 |
| K09 | C109 |
| K10 | C34, C35 |
| K12 | C12, C13 |
| K13 | C13, C40 |
| K26 | C70, C71 |
| K28 | C77, C79, C83 |
| K29 | C73, C89, C92 |
| K30 | C62 |
| K31 | C95 |
| K32 | C37 |
| K33 (money) | C104 |
| K34 | C17, C48, C107 |
| K35 | C29, C30 |

## The five rows that change the most text

1. C13 (kit generations v1, v2, v3 and which `sbx kit` commands accept which) decides the shape of Part 4.
2. C9 and C61 (which agent names and which template images belong to which launch path) decide how 1.1, 1.2, and 2.1 name things.
3. C7, C34, and C35 (secrets never injected from the host, the sentinel formats, where the swap happens) decide 3.5 and the capture K10.
4. C16, C18, C19, C20 (settings and commands that the docs and the CLI disagree on) decide R.3 and the note in 2.5.
5. C48 to C52 (two agent binaries on one machine, the rename, the v1.23.4 restructure) decide 7.3 and every command the manual prints.