Docker packages AI agent permissions as an ordinary OCI image and sends the spec to CNCF

An agent that can read your production database and an agent that can only draft an email look the same to a Docker registry, and the difference between them has been living in a README. Docker's Sandbox Kit Specification writes that difference into the image itself. Version 3 of the spec was published on 24 September 2026, under Apache 2.0, and Docker said at the same time that it is bringing the spec to the Cloud Native Computing Foundation for neutral governance.

Christian Dupuis, who authored the spec post, writes that a Kit now packages the agent, its tools and MCP servers, its skills and instructions, its lifecycle hooks, its port and device access, and the grants defining what the agent may touch. All of it travels in one OCI image, under one content digest.

What changed in v3

The main change in v3 is that a Kit is no longer its own artifact type. Docker writes that "a Kit is now an ordinary OCI image rather than its own artifact: no media type, no sidecar file, nothing for a registry to learn." A Kit can be built with docker buildx build, pulled with standard tooling, and referenced in a FROM statement. The declarations about what the agent may touch live in an annotation, vnd.docker.sandbox.kit.descriptor, inside the same image.

Capabilities are versioned and typed, so a Kit asks for com.docker.sandbox/network-policy@2 or com.docker.sandbox/credential@1, and a runtime that does not recognise one of those stops rather than guessing. Grants compose through mixin overlays with dependency resolution, so a workload Kit for a coding agent and a mixin Kit that grants scoped GitHub access are two artifacts that combine into one running sandbox.

Who is building Kits

Docker's companion post, by Eli Aleyner and Srini Sekaran, lists AWS, Box, Datadog, Dynatrace, JFrog, Palo Alto Networks and Snyk among the organisations building Kits against the spec, and quotes Chris Aniszczyk, CTO at the CNCF, welcoming it. The CNCF project maturity level, the sandbox or incubating step a new spec enters, is not stated in either post.

What runs it

Docker Sandboxes is the only conforming runtime at launch. The InfoQ writeup on 2 October 2026 by Steef-Jan Wiggers notes that cross-runtime portability has not yet been demonstrated in public. The spec repository at docker/sandbox-kit-spec has 124 stars and 383 commits as of today, and Docker is targeting a final v3 for Q4 2026 after community feedback.

A team shipping an agent inside a customer environment gets one artifact to hand to the operator, instead of a Dockerfile, a credentials runbook, a network diagram and a paragraph asking the operator to grant the least access they can. The operator can read the grants off the image, pin the digest, and know that a later pull of the same name will not quietly ask for more. That is the step a specification like this has to take before an agent built by one team can be run by a different team with any confidence.

Source

• From Dockerfile to Kit: the Docker Sandboxes Kit Specification, Christian Dupuis, Docker, 24 September 2026.
• Docker and CNCF partner on an open spec for agent permissions, Eli Aleyner and Srini Sekaran, Docker, 24 September 2026.
• Docker Sandbox Kit Spec: Packaging AI Agent Permissions as OCI Images, Steef-Jan Wiggers, InfoQ, 2 October 2026.
• docker/sandbox-kit-spec repository.