PTIR — Daily Briefing — 2026-09-25
by
Executive Summary
Docker has published Sandbox Kit Specification v3 under Apache 2.0 and is taking it to CNCF for neutral governance. The proposal treats an agent’s authority as versioned infrastructure: the agent, tools, network rules, credential requests, volumes, and other capabilities travel together as an ordinary OCI image that existing registries can store, scan, sign, pin, and diff.
Action Queue
Read the authority model before experimenting with the runtime
The important idea is separation between containment and permission. A microVM can isolate an agent from the host, but it does not explain which external systems, credentials, files, or tools the agent should reach. A Sandbox Kit makes those requests explicit and reviewable. Deny rules can override broader allowances, and credentials can be injected by a proxy so the sandbox sees a sentinel rather than the underlying token.
Recommended action: Read Docker’s worked GitHub CLI example and save the specification. Compare its declared authority with one current coding-agent workflow: list the hosts, credentials, volumes, destructive operations, tools, and instructions that workflow actually needs. Do not adopt the early-access runtime for consequential work until its unsupported capabilities and enforcement behavior have been tested.
- Urgency: This week
- Importance: ★★★★★
- Verified active: September 25, 2026
- Deadline: No deadline
- Cost: The specification and repository are free and open source under Apache 2.0; adoption of the OCI format is free. Docker product or cloud-runtime charges may apply to particular implementations.
- Requirements: Familiarity with Docker/OCI images is helpful. Authoring v3 Kits currently uses Docker Sandboxes early access, Docker Buildx, and the
sbxCLI. Built-inclaudeandcodexshortcuts use v2 and cannot yet be combined with v3 mixins. - Important limitation: A Kit requests authority but grants itself nothing. Its declarations are enforced only by a conforming runtime; without one, the OCI annotation is inert.
- Official overview: From Dockerfile to Kit: the Docker Sandboxes Kit Specification
- Open specification: docker/sandbox-kit-spec
- Authoring documentation: Author kits
- Governance announcement: Docker brings Sandbox Kit Spec to CNCF
Open Source
Version 3 deliberately uses an ordinary OCI image instead of inventing a new artifact type. The descriptor lives in a manifest annotation and its content in image layers, so existing image workflows can build, distribute, sign, scan, and pin it. Docker says the format includes conformance suites for both artifacts and runtimes and is moving toward CNCF governance rather than remaining controlled solely by the first enforcing vendor.
Trends Worth Watching
MCP standardized how agents communicate with tools; Sandbox Kits attempt to standardize the surrounding authority envelope. If the proposal gains multi-runtime support, agent permission changes could become ordinary supply-chain changes—visible in diffs, tied to digests, reviewed before deployment, and rejected when a new version requests more access.
PKb Candidates
- Containment is not authority: Isolation limits where damage can spread; declared capabilities limit what the agent is intentionally allowed to reach.
- Authority as a supply-chain artifact: Pin the agent, tools, permissions, credentials requests, and operating context to one reviewable digest.
- Enforcement test: A permission document is not a security boundary unless the runtime demonstrably denies undeclared and explicitly forbidden actions.