--- title: Docker Sandbox Kit Spec: Packaging AI Agent Permissions... description: Docker is contributing the Sandbox Kit Specification to the CNCF, a v3 Apache 2.0 spec that packages an AI agent, its tools, and a typed declaration of hosts,... canonical: https://daily.dev/posts/docker-sandbox-kit-spec-packaging-ai-agent-permissions-as-oci-images-bjwllxevt twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images | daily.dev og:description: Docker is contributing the Sandbox Kit Specification to the CNCF, a v3 Apache 2.0 spec that packages an AI agent, its tools, and a typed declaration of hosts,... og:url: https://daily.dev/posts/docker-sandbox-kit-spec-packaging-ai-agent-permissions-as-oci-images-bjwllxevt og:image: https://api.daily.dev/og/posts/bJWllxEvt.png og:image:alt: Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 0 upvotes · 0 comments ## Summary Docker is contributing the Sandbox Kit Specification to the CNCF, a v3 Apache 2.0 spec that packages an AI agent, its tools, and a typed declaration of hosts, credentials, and volumes it needs into a standard OCI image with no custom media type. Declarations such as network-policy and credential capabilities are typed and versioned, with deny-wins semantics, proxy-managed credentials, and mixin overlays resolved via a provides/requires dependency graph. A Kit only requests permissions while the host runtime decides and enforces them; Docker Sandboxes, running agents in microVMs, is currently the only conforming runtime, so cross-runtime portability is unproven. Docker built the spec with partners including AWS, Box, Datadog, Dynatrace, JFrog, Palo Alto Networks, and Snyk, and ships conformance suites for both Kit artifacts and runtimes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the Docker Sandbox Kit Spec and how does it package AI agent permissions? It is an Apache 2.0 specification, now at v3, that packages an AI agent, its tools, and a typed list of the hosts, credentials, and volumes it requests into an ordinary OCI image. The manifest uses one declaration, vnd.docker.sandbox.kit.descriptor, with no custom media type, so a Kit can be built with docker buildx build, pulled with docker pull, and scanned or signed like any image. _Teams standardizing how AI agents get scoped permissions can follow spec developments like this on daily.dev._ ### Which runtime currently enforces Docker Sandbox Kit permissions? Docker Sandboxes, which runs agents in microVMs with their own kernel, is the first and currently only conforming runtime for the Sandbox Kit spec. A Kit only requests permissions while the host runtime decides whether to grant them, so without a conforming runtime the permission annotations are inert, and portability across different runtimes has not yet been demonstrated. _Engineers evaluating agent sandboxing options can track runtime conformance updates on daily.dev._ ### How does deny-wins conflict resolution work in Docker Sandbox Kit network policies? When declarations overlap, deny rules take precedence over allow rules. In the spec's GitHub CLI example, a Kit allows api.github.com but denies DELETE on /repos/**, and since deny wins, that delete operation is blocked even though the domain itself is permitted, giving a predictable way to scope agent API access. _Developers writing agent permission policies can compare conflict-resolution approaches via daily.dev._ ## Similar posts on daily.dev - [Docker Brings Sandbox Kit Spec to the CNCF](https://daily.dev/posts/docker-brings-sandbox-kit-spec-to-the-cncf-s5knbsucl) · Docker · 1 upvotes · 0 comments - [Why AI Agents Need Isolation with Docker SBX](https://daily.dev/posts/why-ai-agents-need-isolation-with-docker-sbx-maacb8xi9) · Docker · 2 upvotes · 1 comments - [Open-Source Agent Sandbox Enables Secure Deployment of AI Agents on Kubernetes](https://daily.dev/posts/open-source-agent-sandbox-enables-secure-deployment-of-ai-agents-on-kubernetes-ichq19lcg) · InfoQ · 1 upvotes · 0 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#docker](https://daily.dev/tags/docker), [#cncf](https://daily.dev/tags/cncf) [View this post on daily.dev](https://daily.dev/posts/docker-sandbox-kit-spec-packaging-ai-agent-permissions-as-oci-images-bjwllxevt) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images","url":"https://daily.dev/posts/docker-sandbox-kit-spec-packaging-ai-agent-permissions-as-oci-images-bjwllxevt","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/docker-sandbox-kit-spec-packaging-ai-agent-permissions-as-oci-images-bjwllxevt"},"datePublished":"2026-10-02T09:04:18.625Z","dateModified":"2026-10-06T18:48:07.325Z","description":"Docker is contributing the Sandbox Kit Specification to the CNCF, a v3 Apache 2.0 spec that packages an AI agent, its tools, and a typed declaration of hosts,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/820955a2d8fb759d0833efeba2d1b7bf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/820955a2d8fb759d0833efeba2d1b7bf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/docker-sandbox-kit-spec-packaging-ai-agent-permissions-as-oci-images-bjwllxevt","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,docker,cncf","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/docker-sandbox-kit-spec-packaging-ai-agent-permissions-as-oci-images-bjwllxevt#faq","mainEntity":[{"@type":"Question","name":"What is the Docker Sandbox Kit Spec and how does it package AI agent permissions?","acceptedAnswer":{"@type":"Answer","text":"It is an Apache 2.0 specification, now at v3, that packages an AI agent, its tools, and a typed list of the hosts, credentials, and volumes it requests into an ordinary OCI image. The manifest uses one declaration, vnd.docker.sandbox.kit.descriptor, with no custom media type, so a Kit can be built with docker buildx build, pulled with docker pull, and scanned or signed like any image. Teams standardizing how AI agents get scoped permissions can follow spec developments like this on daily.dev."}},{"@type":"Question","name":"Which runtime currently enforces Docker Sandbox Kit permissions?","acceptedAnswer":{"@type":"Answer","text":"Docker Sandboxes, which runs agents in microVMs with their own kernel, is the first and currently only conforming runtime for the Sandbox Kit spec. A Kit only requests permissions while the host runtime decides whether to grant them, so without a conforming runtime the permission annotations are inert, and portability across different runtimes has not yet been demonstrated. Engineers evaluating agent sandboxing options can track runtime conformance updates on daily.dev."}},{"@type":"Question","name":"How does deny-wins conflict resolution work in Docker Sandbox Kit network policies?","acceptedAnswer":{"@type":"Answer","text":"When declarations overlap, deny rules take precedence over allow rules. In the spec's GitHub CLI example, a Kit allows api.github.com but denies DELETE on /repos/**, and since deny wins, that delete operation is blocked even though the domain itself is permitted, giving a predictable way to scope agent API access. Developers writing agent permission policies can compare conflict-resolution approaches via daily.dev."}}]} ```