Settings reference

Every setting Dozer has is in one file, ~/.config/dozer-sandbox/doz.toml (under $XDG_CONFIG_HOME when that is set). The file lists every setting with a description and its default, commented out; only the values you set are uncommented. The dashboard's Settings page shows and edits the same file.

Where a value comes from#

For each setting, the first of these that says something wins:

1. a command-line flag (for the few settings that have one — --store, --progress, doz create --cpus, …);
2. its environment variable (DOZ_STORE, DOZ_PROGRESS, DOZ_HOST_IDLE, DOZ_SCREEN_CAPTURE, DOZ_BOOT_LOGS, DOZ_SUBNET, DOZ_KERNEL, DOZ_KERNEL_CACHE);
3. the file;
4. the default.

doz config show names the source of every value. A few settings can also be one sandbox's own (below); a sandbox's own value wins over the file's.

Read and change settings#

doz config                                  # every setting: value, source, default
doz config get ui.theme                     # one value (--json adds its source and default)
doz config set ui.theme dark                # write it to the file (checked against its type first)
doz config unset ui.theme                   # back to the default (commented out again)
doz config init                             # write the file with every setting commented out
doz config path                             # where the file is

In the dashboard: Settings lists every setting with its value, default, description and source, and changes it in place (Default puts one back). A value set by an environment variable, and the settings that name a folder on your Mac, are shown read-only there — change them with doz config set.

Per sandbox#

sandbox.clipboard, sandbox.browser_bridge, sandbox.open_files, sandbox.ssh_agent, sessions.tmux and sandbox.agent_sudo can also be set for one sandbox:

doz config show --sandbox my-app                          # its values, and whose value each is
doz config set --sandbox my-app sandbox.clipboard off
doz config get --sandbox my-app sessions.tmux
doz config unset --sandbox my-app sandbox.clipboard       # follow the setting again

Or when you create it (doz create --clipboard off --browser-bridge off --open-files off --ssh-agent on --tmux --no-agent-sudo), or in its doz_project.yaml (clipboard:, browser_bridge:, open_files:, ssh_agent:, tmux:, agent_sudo:).

"Use GitHub as you" is a permission, not a setting: doz net allow NAME github:as-you (and github:push), doz create --github read|push, github: in doz_project.yaml — see GitHub as you.

About the file#

• The file is Dozer's. set, unset, init and the Settings page rewrite it whole, atomically, readable only by you. Comments you add aren't kept.
• A mistake never breaks Dozer. An unknown key or a value of the wrong type is a warning (that line is ignored, the default applies). A file that doesn't parse at all is ignored — with the line that's wrong — and never overwritten until you fix it.
• When a change applies is part of each setting: at once, for the next command, the next sandbox created, the next session, the next start or wake, or after doz host stop.

Not settable, on purpose#

The dashboard's security limits and checks (session and link lifetimes, request and connection caps, the Host/Origin/CSRF checks, the content policy); a browser terminal's one-use tickets and paste limits; the guest programs; and any credential. ui.terminals can only take something away.

Every setting#

This table is generated from doz config show and checked against it on every build.

[ui]#

[serve]#

[host]#

[store]#

[claude]#

[codex]#

[defaults]#

[agent]#

[updates]#

[resources]#

[sandbox]#

[sessions]#

[bridges]#

[workspace]#

[github]#

[images]#

[images.lab]#

[images.claude-code]#

[images.pi]#

[images.codex]#

[kernel]#

Environment variables#