Docker hands Sandbox Kit spec to CNCF to package AI agent permissions as OCI images

Docker announced it is donating the Apache 2.0 Sandbox Kit Specification v3 to the CNCF, packaging an AI agent, its tools and a typed list of requested hosts, credentials and volumes into a standard OCI image. Docker Sandboxes, which run agents in microVMs, is the first conforming runtime; AWS, Box, Datadog, Dynatrace, JFrog, Palo Alto Networks and Snyk helped build Kits.

• Apache 2.0 spec v3 packages an agent and its permissions as an OCI image
• Kits build with docker buildx build and scan like ordinary images
• Permissions are typed: com.docker.sandbox/network-policy@2, credential@1
• Docker Sandboxes microVM runtime is the first conforming implementation