sbx: document Linux keychain fallback for headless hosts#25232
Conversation
On Linux without a running Secret Service (headless servers, some WSL setups), sbx falls back to an encrypted on-disk store instead of the OS keychain. Document where secrets are stored per platform in the credentials page and add a headless-Linux FAQ entry. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The added content is well-structured and clearly documents the Linux keychain fallback behavior. No critical issues found — no vendored content, no missing redirects, no broken commands or incorrect facts. Cross-linking between faq.md and credentials.md uses correct relative paths and anchor fragments. Only minor style-guide items noted below.
akristen
left a comment
akristen
left a comment
There was a problem hiding this comment.
non-blocking nit: but our faq docs titles tend to be the plural faqs rather than faq.
Remove parentheses from the XDG config path per the style guide and make the per-OS storage list parallel by moving the Ubuntu package note into prose. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
@akristen thanks! The bot's two style nits are addressed in 068f346 (dropped parentheses, made the per-OS list parallel). On the |
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
The PR is well-scoped and clearly written. It adds a new FAQ entry and a "Where secrets are stored" section to the credentials page, both documenting the Linux encrypted-file fallback when no Secret Service is running. The writing is clean — no hedge words, no meta-commentary, no marketing language. No structural or Hugo issues found.
Three minor style suggestions are left as inline comments (low-severity only).
Split the em-dash into two sentences and replace the "a common setup" hedge with a direct imperative, per review. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
dvdksn
added
the
status/do-not-merge
docker-agent
left a comment
docker-agent
left a comment
There was a problem hiding this comment.
Assessment: 🟡 NEEDS ATTENTION
One path accuracy concern found in the new content across both changed files. The overall writing is clean, well-scoped, and follows the style guide.
| Yes. On Linux, `sbx` stores secrets in the Secret Service exposed by your | ||
| desktop keyring, such as GNOME Keyring or KDE Wallet. Headless servers and some | ||
| WSL setups have no running Secret Service, so `sbx` falls back to an encrypted | ||
| file under `$XDG_CONFIG_HOME/com.docker.sandboxes`, which defaults to |
There was a problem hiding this comment.
[LIKELY HIGH] Linux fallback path may use the wrong namespace
Both new sections document the Linux credential fallback path as $XDG_CONFIG_HOME/com.docker.sandboxes (defaulting to ~/.config/com.docker.sandboxes), but every other Linux XDG path in the project uses the namespace sandboxes — not com.docker.sandboxes. For example, troubleshooting.md shows:
~/.local/state/sandboxes/
~/.cache/sandboxes/
~/.config/sandboxes/
The com.docker.sandboxes naming is macOS convention (reverse-DNS Application Support directories). If the actual Linux on-disk path is ~/.config/sandboxes/ (consistent with all other Linux paths), the documentation would mislead users looking for the encrypted fallback file.
Please confirm the correct path against the implementation in docker/sandboxes#3231.
|
|
||
| On Linux hosts without a running Secret Service — headless servers and some | ||
| WSL setups — `sbx` falls back to an encrypted file under your user config | ||
| directory `$XDG_CONFIG_HOME/com.docker.sandboxes`, which defaults to |
There was a problem hiding this comment.
[LIKELY HIGH] Linux fallback path may use the wrong namespace
Same issue as above: $XDG_CONFIG_HOME/com.docker.sandboxes (defaulting to ~/.config/com.docker.sandboxes) does not match the Linux XDG namespace pattern used elsewhere in the docs (sandboxes, not com.docker.sandboxes). If the actual path is ~/.config/sandboxes/, users following this documentation won't find the file.
4 participants
Summary
On Linux hosts without a running Secret Service (headless servers, some WSL setups),
sbxfalls back to an encrypted on-disk store instead of the OS keychain. This documents where secrets are stored per platform in the credentials page and adds a headless-Linux FAQ entry.Note
This documents behavior from the unreleased PR docker/sandboxes#3231. Hold merge until that change ships. Opened as a draft for that reason.
Learnings
Closes #linkage.Generated by Claude Code