Docker Sandbox Kit Spec: Authority as Code | Docker

This post introduces the Docker Sandbox Kit Specification v3, standardizing the definition of an agent's required authority (network policies, credentials, volumes, lifecycle hooks) within an OCI image. It details the composition rules for Kits (workloads and mixins) and the normative grammar for capability types, ensuring interoperability and enabling reviewable authority grants. The specification aims to make authority reproducible and auditable, moving beyond ad-hoc configurations in Dockerfiles and run commands.