AICreated on October 25, 20262 min read

Using AI in Docker Sandboxes? Refresh certificates inside existing environments

Docker refreshed built-in templates on October 21. Updating the CLI alone leaves existing sandboxes unchanged.

What changed

Docker’s October 21 guidance refreshes sandbox certificate trust following the eMudhra incident. An sbx CLI update alone does not update existing sandboxes. This matters when an AI coding environment downloads dependencies or connects to HTTPS services.

Who should check

Check the sandbox where the agent actually runs, rather than only the host machine. A cached template and a running sandbox are separate environments. Custom images and tools with their own certificate bundles need individual checks.

What to do

List the environments you use and identify their base images, package managers and important local work.
Follow Docker’s documented certificate update for a retained sandbox where suitable. For Ubuntu-based templates the guidance updates ca-certificates, then restarts applications; separately refresh tools with bundled roots.
If recreating instead, first preserve needed files and unpushed commits. Fetch the new template with --pull always and restore the original creation options. Removing a sandbox deletes its filesystem.

Verify the result

Test dependency downloads and HTTPS access inside the refreshed environment without bypassing TLS checks. Record whether you updated the existing sandbox or recreated it, and verify preserved work before any deletion.

Official sources

Docker · Sandboxes certificate incident response

Take it into your project

Get the files, keep the guide, or give your coding assistant a ready-to-use brief.

Download guideMarkdown Download AI setup briefEnglish · Markdown

Set it up with AI

Copy this English prompt into your coding assistant. It includes the article, available files and project setup steps.

View the setup prompt

AI setup prompt · English

Read this news or bug-fix article as reference material:
https://nethanelfitoussi.com/article/docker-sandboxes-october-2026-certificate-refresh?lang=en

Goal: apply the documented workflow to my development project.
Read the existing project instructions, inspect the relevant files and explain the smallest useful setup.

Use the article and its examples as references. Identify any missing project files before making changes.

If I have not supplied a project folder, ask which development project to use. Do not invent a repository URL.

Additional project setup instructions:
Using https://docs.docker.com/security/security-announcements/ and its October 21, 2026 Docker Sandboxes certificate guidance, inventory my existing sandboxes, template origins and bundled trust stores. Updating the sbx CLI alone does not update existing sandboxes. Prefer a documented non-destructive certificate update where suitable; for Ubuntu-based built-in templates Docker documents updating ca-certificates and restarting applications. If proposing recreation, first identify files and unpushed commits that must be exported, restore creation options and fetch updated templates with --pull always. Never run sbx rm or delete a sandbox without my explicit approval after preservation is verified. Also identify tools that bundle their own CA roots. Do not disable certificate verification or change production.

Check the dated advisory and current official vendor guidance. Identify whether my installed version and configuration are affected before proposing a fix.

Give me a short plan, then make the agreed local changes and run the relevant checks. Report actual results and anything not verified. Stop before credentials, paid services, production changes, push, merge or deployment.

The prompt

Using https://docs.docker.com/security/security-announcements/ and its October 21, 2026 Docker Sandboxes certificate guidance, inventory my existing sandboxes, template origins and bundled trust stores. Updating the sbx CLI alone does not update existing sandboxes. Prefer a documented non-destructive certificate update where suitable; for Ubuntu-based built-in templates Docker documents updating ca-certificates and restarting applications. If proposing recreation, first identify files and unpushed commits that must be exported, restore creation options and fetch updated templates with --pull always. Never run sbx rm or delete a sandbox without my explicit approval after preservation is verified. Also identify tools that bundle their own CA roots. Do not disable certificate verification or change production.

Read the original sourceDocker · Sandboxes certificate incident response

DockerAI codingCertificatesSecurity