Docker Proposes Standard for Packaging AI Agent Permissions as OCI Images

Docker has submitted a specification to the CNCF for standardizing how AI agent permissions are packaged and distributed. The Sandbox Kit Specification treats access controls—such as network policies, credentials, and file system mounts—as part of the container image itself, rather than as implicit configurations buried in shell history or environment variables.

The Problem with Current Agent Security#

AI agents like Claude Code and OpenAI's Codex execute actions on a user's behalf: installing packages, calling APIs, and accessing credentials. However, the permissions these agents receive are typically scattered and invisible. Bind mounts, API tokens, and firewall rules exist in scattered documentation, shell configurations, and memory rather than in inspectable artifacts. Docker argues this fragmentation mirrors the image format chaos that prompted the creation of OCI standards in the first place—without a common approach, every platform will invent its own solution.

How the Kit Specification Works#

In its current v3 iteration, the specification packages an agent, its tools, and a typed list of permissions into an ordinary OCI image. A Kit can be built, pulled, signed, and scanned using familiar container workflows (docker buildx build, docker pull). Pinning the image digest simultaneously locks both the agent code and its permission set.

Permissions are declared as typed and versioned capabilities, such as com.docker.sandbox/network-policy@2 or com.docker.sandbox/credential@1. In a real example, a Kit can allow access to api.github.com while explicitly denying DELETE operations on specific repository paths—with deny rules taking precedence. Credentials can be proxy-managed, meaning a conforming runtime intercepts requests and injects the real token only for authorized domains, while the sandbox itself sees only a placeholder.

A launch can combine one base workload Kit with multiple overlay Kits (called mixins). The system resolves dependencies using a provides/requires graph rather than flag order, and conflicts are flagged as errors.

Ecosystem Support and Open Governance#

Docker developed the spec in collaboration with cloud and security vendors including AWS, Box, Datadog, Dynatrace, JFrog, Palo Alto Networks, and Snyk. CNCF CTO Chris Aniszczyk endorsed the move, drawing a parallel to Docker's earlier donation of the image format and runc to establish OCI.