NEWS · CODING · #1427
Docker submits Sandbox Kit Specification v3 to CNCF, packs agent permissions as OCI images
Docker announced the Sandbox Kit Specification v3 (Apache‑2.0), which encodes an AI agent, its tools, and a typed declaration of requested hosts, credentials, and volumes into ordinary OCI images, and said it is bringing the spec to the CNCF. Docker Sandboxes (microVM‑based runtimes) is the first conforming runtime; enforcement depends on runtimes and the posts do not state whether the spec has been accepted into a CNCF program.
KEY POINTS
- Docker announced the Sandbox Kit Specification v3 (Apache‑2.0), which encodes an AI agent, its tools, and a typed declaration of requested hosts, credentials, and volumes into ordinary OCI images, and said it is bringing the spec to the CNCF.
- Docker Sandboxes (microVM‑based runtimes) is the first conforming runtime; enforcement depends on runtimes and the posts do not state whether the spec has been accepted into a CNCF program.
- Standardizing agent permissions as OCI images can make agent behaviour, credentials, and guardrails portable, reviewable, and integrable with existing registry tooling — but real portability requires multiple conforming runtimes.
WHY IT MATTERS
Standardizing agent permissions as OCI images can make agent behaviour, credentials, and guardrails portable, reviewable, and integrable with existing registry tooling — but real portability requires multiple conforming runtimes.