docker · dvdksn · Sep 7, 2026 · Sep 7, 2026 · Sep 7, 2026
diff --git a/content/get-started/tutorials/run-an-agent.md b/content/get-started/tutorials/run-an-agent.md
@@ -18,7 +18,9 @@ daemon. Your project remains available on your host, while tools the agent
 installs and system changes it makes stay inside an environment you can
 discard.
 
-In this tutorial, you'll move an existing coding-agent workflow into a sandbox.
+In this tutorial, you'll move an existing coding-agent workflow into a local
+sandbox. For a cloud workflow, see
+[Get started with cloud sandboxes](/manuals/ai/sandboxes/cloud/_index.md#get-started).
 
 ## Before you start
 

diff --git a/content/manuals/agentic-platform/_index.md b/content/manuals/agentic-platform/_index.md
@@ -47,8 +47,11 @@ sandboxes on Docker-managed cloud infrastructure. An active workload is not
 tied to your computer remaining awake or connected. You can leave the Console
 and return to the sandbox while the agent continues working.
 
-For sandboxes that run on your development machine through the `sbx` CLI, see
-[Docker Sandboxes](/manuals/ai/sandboxes/_index.md).
+The `sbx` CLI supports both
+[local sandboxes](/manuals/ai/sandboxes/get-started.md) and
+[cloud sandboxes](/manuals/ai/sandboxes/cloud/_index.md). These pages describe
+the web Console experience. The Console and CLI use different secret names;
+see [Cloud credentials](/manuals/ai/sandboxes/cloud/credentials.md).
 
 From the web Console, choose the type of sandbox to run and configure its model
 credential, network access, tools, and compute. Docker creates the sandbox and

diff --git a/content/manuals/agentic-platform/faq.md b/content/manuals/agentic-platform/faq.md
@@ -17,14 +17,18 @@ Docker-hosted sandbox with a live terminal.
 ## How does Docker Agentic Platform differ from Docker Sandboxes?
 
 Docker Agentic Platform runs sandboxes on Docker-managed cloud infrastructure
-through a web Console. Docker Sandboxes runs sandboxes on your development
-machine through the `sbx` command. Docker Agentic Platform manages the compute,
-MCP connections, secrets, and network policies used by its hosted sandboxes.
+through a web Console. The `sbx` CLI runs local sandboxes on your development
+machine and cloud sandboxes with `sbx --cloud`. The Console and CLI have
+different workflows and secret names. See
+[Cloud sandboxes](/manuals/ai/sandboxes/cloud/_index.md) for the CLI experience.
 
 ## Can I move a sandbox between my machine and Docker Agentic Platform?
 
-No. Local and hosted sandboxes are separate in the initial release. You cannot
-move a running sandbox or its local bind mounts into Docker Agentic Platform.
+The `sbx move` command copies a sandbox filesystem between local and cloud
+environments. It does not transfer running processes, host bind mounts, or
+managed secrets, and it leaves the source sandbox in place. See
+[Move a sandbox](/manuals/ai/sandboxes/cloud/move.md) for the CLI workflow and
+its limitations.
 
 ## Can I share sandboxes and configuration with a team?
 

diff --git a/content/manuals/ai-overview.md b/content/manuals/ai-overview.md
@@ -33,10 +33,11 @@ in YAML. You configure agents with specific roles, models, and tools, then
 run them from your terminal. Docker Agent is a general-purpose agent runtime,
 not specific to Docker tasks.
 
-**Docker Sandboxes** provides isolated microVM environments for running coding
-agents. It supports multiple agents including Claude Code, Codex, Copilot,
-Devin, Gemini, and Docker Agent. Sandboxes is the isolation layer — the agents
-themselves are separate tools.
+Docker Sandboxes provides isolated environments for running coding agents
+[locally](./ai/sandboxes/get-started.md) or
+[in the cloud](./ai/sandboxes/cloud/_index.md). Sandboxes is the isolation layer;
+the agents themselves are separate tools. Agent configuration and supported
+features differ between local and cloud sandboxes.
 
 **Model Runner** lets you run LLMs locally. Other tools like Docker Agent can
 use Model Runner as a model provider.

@@ -8,37 +8,39 @@ params:
     group: AI and agents
 ---
 
-Docker Sandboxes run AI coding agents in isolated microVM sandboxes. Each
-sandbox gets its own Docker daemon, filesystem, and network — the agent can
-build containers, install packages, and modify files without accessing host
-resources beyond those you share.
+Docker Sandboxes run AI coding agents in isolated environments on your machine
+or on Docker-managed cloud infrastructure. Use the `sbx` CLI to create and
+manage either kind of sandbox.
 
-> [!NOTE]
-> The `sbx` CLI is free to use, including for commercial work. Only
-> [organization governance](governance/) requires a separate paid subscription.
+The `sbx` CLI and local sandbox compute are free to use, including for commercial
+work. Cloud compute is metered through a
+[Docker Agentic Platform plan](/manuals/subscription-billing/plans/docker-agentic-platform.md).
+Model-provider charges are separate.
 
 Organization admins can
 [centrally manage sandbox network, filesystem, and MCP policies](governance/access-controls/organization.md),
-so the same controls apply uniformly across every developer's machine.
+for local sandboxes across developer machines.
 Available on a separate paid subscription.
 
 ## Get started
 
-Follow the [installation guide](install.md) to check the system requirements,
-install the `sbx` CLI, and sign in.
+[Install the `sbx` CLI](install.md) and sign in, then choose where to run your
+agent:
 
-Then launch an agent in a sandbox:
+| Environment | Use it for | Start here |
+| --- | --- | --- |
+| Local sandboxes | Work with files and supported hardware on your machine | [Get started locally](get-started.md) |
+| Cloud sandboxes | Run on Docker-managed compute without local virtualization | [Get started in the cloud](cloud/_index.md#get-started) |
 
-```console
-$ cd ~/my-project
-$ sbx run claude
-```
-
-See the [get started guide](get-started.md) for a first-session walkthrough, or
-jump to the [usage guide](usage.md) for basic commands.
+The two environments have separate credentials, network policies, and lifecycle
+controls. See [Compare local and cloud sandboxes](cloud/local-vs-cloud.md)
+before adapting a workflow.
 
 ## Learn more
 
+The following guides describe local sandbox workflows. For cloud workflows,
+see [Cloud sandboxes](cloud/).
+
 - [Agents](agents/) — supported agents and per-agent configuration
 - [Workflows](workflows/) — patterns for Git, local development,
   authentication, agent skills, and automation

@@ -6,6 +6,10 @@ description: AI coding agents supported by Docker Sandboxes.
 keywords: docker sandboxes, ai agents, claude code, codex, cursor, devin, gemini
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 Docker Sandboxes runs the following agents out of the box:
 
 - [Claude Code](claude-code/)

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, claude code, anthropic, ai agent, sbx, local models, llmman, ollama
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 Official documentation: [Claude Code](https://code.claude.com/docs)
 
 ## Quick start

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, codex, openai, ai agent, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 This guide covers authentication, configuration, and usage of Codex in a
 sandboxed environment.
 

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, github copilot, ai agent, github token, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 This guide covers authentication, configuration, and usage of GitHub Copilot
 in a sandboxed environment.
 

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, cursor, cursor agent, ai agent, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 This guide covers authentication, configuration, and usage of Cursor in a
 sandboxed environment.
 

@@ -5,6 +5,10 @@ description: Use Devin CLI in Docker Sandboxes with reusable, proxy-managed auth
 keywords: docker sandboxes, devin, cognition, ai agent, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 Official documentation: [Devin CLI](https://docs.devin.ai/work-with-devin/devin-cli)
 
 ## Quick start

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, docker agent, openai, anthropic, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 Official documentation: [Docker Agent](/manuals/ai/docker-agent/_index.md)
 
 ## Quick start

@@ -6,6 +6,10 @@ description: |
 keywords: docker sandboxes, droid, factory, ai agent, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 This guide covers authentication, configuration, and usage of Droid, an AI
 coding agent by Factory, in a sandboxed environment.
 

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, gemini, google, ai agent, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 This guide covers authentication, configuration, and usage of Google Gemini in
 a sandboxed environment.
 

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, kiro, ai agent, authentication, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 This guide covers authentication, configuration, and usage of Kiro in a
 sandboxed environment.
 

@@ -7,6 +7,10 @@ description: |
 keywords: docker sandboxes, opencode, ai agent, authentication, sbx
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 This guide covers authentication, configuration, and usage of OpenCode in a
 sandboxed environment.
 

@@ -5,6 +5,10 @@ description: Run an agent-less sandbox with a Bash login shell for manual setup,
 keywords: sandboxes, sbx, shell, agent, manual setup, testing
 ---
 
+The following instructions apply to local sandboxes. For cloud authentication
+and usage, see [Authenticate cloud agents](../cloud/credentials.md) and
+[Use cloud sandboxes](../cloud/usage.md).
+
 `sbx run shell` drops you into a Bash login shell inside a sandbox with no
 pre-installed agent binary. It's useful for installing and configuring
 agents manually, testing custom implementations, or inspecting a running

@@ -5,6 +5,9 @@ description: Technical architecture of Docker Sandboxes; workspace mounting, sto
 keywords: docker sandboxes, architecture, microVM, workspace mounting, sandbox lifecycle
 ---
 
+This page describes local sandboxes and their host integrations. For the cloud
+operating model, see [Compare local and cloud sandboxes](cloud/local-vs-cloud.md).
+
 This page explains how Docker Sandboxes work under the hood. For the security
 properties of the architecture, see [Sandbox isolation](security/isolation.md).
 

@@ -0,0 +1,107 @@
+---
+title: Cloud sandboxes
+description: Run Docker Sandboxes on Docker-managed cloud infrastructure and understand the cloud-specific command, storage, and billing model.
+keywords: docker sandboxes, cloud sandboxes, sbx cloud, ai agents, agentic platform
+weight: 35
+---
+
+Cloud sandboxes run AI agents on Docker-managed infrastructure instead of your
+local machine. Use them when you need an isolated environment that doesn't
+depend on the compute resources or virtualization support of your host.
+
+Cloud sandboxes use the same `sbx` CLI as local sandboxes. Add the global
+`--cloud` flag to send a supported command to the Cloud Sandboxes API:
+
+```console
+$ sbx --cloud ls
+```
+
+Cloud and local sandboxes have separate state and different capabilities. A
+cloud sandbox can't mount a host workspace or use host hardware, and its
+secrets, network policy, ports, and lifecycle are managed in the cloud. See
+[Local and cloud differences](local-vs-cloud.md) before adapting a local
+workflow.
+
+## Prerequisites
+
+To use cloud sandboxes, you need:
+
+- The [`sbx` CLI](../install.md), version 0.42.0 or later
+- A Docker account signed in through `sbx login`
+- An active [Docker Agentic Platform plan](/manuals/subscription-billing/plans/docker-agentic-platform.md)
+
+To subscribe, open [Docker Agentic Platform](https://agentic-platform.docker.com/)
+and sign in. The plan is available for Docker Personal and Docker Pro accounts.
+
+Cloud sandbox compute is metered through the Docker Agentic Platform
+pay-as-you-go plan. Inference charges aren't included. Your model provider
+charges for requests made with the API keys or OAuth credentials that you
+configure.
+
+## Get started
+
+Credentials configured for local sandboxes aren't available to cloud
+sandboxes. Configure a cloud credential for your agent before launching it.
+For example, authenticate Claude Code with Anthropic OAuth:
+
+```console
+$ sbx --cloud secret set anthropic --oauth
+```
+
+Cloud sandboxes expire after one hour by default and are deleted when they
+expire. Copy out work you want to keep before expiration. For other timeout
+options, see [Configure expiration](usage.md#configure-expiration).
+
+Create a sandbox without attaching, allowing access to GitHub for this example:
+
+```console
+$ sbx --cloud create --name cloud-project --allow-network github.com:443 claude
+```
+
+Cloud sandboxes don't accept a local workspace path. Clone the public
+[Welcome to Docker repository](https://github.com/docker/welcome-to-docker)
+inside the sandbox:
+
+```console
+$ sbx --cloud exec cloud-project git clone \
+    https://github.com/docker/welcome-to-docker.git /home/agent/workspace/project
+```
+
+Attach to the agent:
+
+```console
+$ sbx --cloud attach cloud-project
+```
+
+Ask Claude to inspect `/home/agent/workspace/project` and write a description
+of the application to `/home/agent/workspace/review.md`. When the file is ready,
+press `Ctrl+\` to detach and leave the agent running.
+
+Copy the result to your machine:
+
+```console
+$ sbx --cloud cp cloud-project:/home/agent/workspace/review.md ./review.md
+```
+
+Read the result, then remove the sandbox when you're finished:
+
+```console
+$ sbx --cloud rm cloud-project
+```
+
+Removal deletes files stored only in the sandbox. For your own projects, see
+[Transfer files](usage.md#transfer-files) and
+[Authenticate cloud agents](credentials.md) before cloning private repositories.
+
+## Learn more
+
+- [Local and cloud differences](local-vs-cloud.md) compares the two execution
+  environments
+- [Use cloud sandboxes](usage.md) covers creation, files, ports, and lifecycle
+- [Authenticate cloud agents](credentials.md) covers cloud-specific secrets,
+  OAuth, and safe sign-in workflows
+- [Manage cloud network policy](network-policy.md) covers account-level and
+  sandbox-level network access
+- [Move a sandbox](move.md) explains filesystem transfers between local and
+  cloud environments
+- [`sbx` CLI reference](/reference/cli/sbx/) lists commands and options