Docker's Sandbox Kit spec bundles an AI agent, its tools, and its requested permissions into a single OCI…