Docker Unveils Sandbox Kit Spec v3 for Agent Permissions

Packaging Agent Authority into Standard Images

Docker has published the Docker Sandbox Kit Specification v3 as an open-source project under the Apache 2.0 license. The specification addresses the challenge of managing what autonomous coding agents and workloads are allowed to touch, packaging network policies, credentials, and volumes directly alongside application code.

While traditional Dockerfiles define how software is built and started, they leave external requirements scattered across run flags, Compose files, and shell history. The new Kit specification encodes these operational boundaries into a standardized format distributed via ordinary OCI images and registry workflows.

How Kits and Conforming Runtimes Interact

Under the v3 specification, a Kit utilizes standard image layers combined with a specific manifest annotation. Kits are split into two primary types: workloads that supply the root filesystem, and mixins that act as overlays for network rules, context, and credentials. Each capability declaration within a Kit acts as a request rather than an automatic grant.

Conforming runtimes evaluate these requests against host capabilities before launching an environment. If a required resource cannot be satisfied or if rules conflict, the runtime blocks the execution. This ensures that permissions are version-controlled, auditable through standard git diffs, and restricted to explicitly authorized domains and actions.

What This Changes for Developers

For practitioners and self-hosters deploying automated tooling, the specification shifts permission management from unwritten assumptions to trackable artifacts. By pinning image digests, teams can review permission expansions in pull requests and prevent unintended privilege escalation without relying on manual configuration scripts or vendor-locked tooling.

Source

Official announcement or documentation