The permissions behind an AI agent usually live in shell history and dashboards, not in anything a reviewer can inspect. Docker wants to fix that by treating a bundle of agent, tools, and requested access as a plain OCI image it calls a Kit.
The Apache 2.0 Sandbox Kit Specification, now at version 3, was announced at WeAreDevelopers on September 24 and is being handed to the CNCF. A Kit lists, in typed form, the hosts, credentials, and volumes an agent asks for.
Version 3 folded the Kit into the standard image format. There is no separate artifact type or sidecar file, just one declaration in the manifest, so a Kit can be built with buildx, pulled, scanned, signed, or used in a FROM line. Access rules are typed and versioned, for instance a network policy or a credential grant. A GitHub CLI example permits api.github.com while refusing repository deletes, since deny wins.
A Kit can only ask; the runtime holds the power, and a launch dies if a required permission goes unmet. Docker’s own Sandboxes product, which gives each agent a microVM with its own kernel, is the first to honor the spec. Partners including AWS, Snyk, Datadog, and Palo Alto Networks contributed to the Kits, the company says.
