Docker Brings Sandbox Kit Spec to the CNCF | Docker

This post introduces the Docker Sandbox Kit Spec, which defines a standard for packaging AI agents, their tools, and their requested permissions (hosts, credentials, volumes) as an OCI image. This spec is being donated to the CNCF to foster an open ecosystem for agent security and portability. The key technical contribution is the definition of an OCI image extension point that allows for the inclusion of a typed list of agent requests, enabling runtime enforcement and improved transparency. This builds upon the existing Docker Sandbox Kit concept by making it an open standard.