Docker hands its agent permissions spec to the CNCF

Docker is handing the Sandbox Kit Spec to the Cloud Native Computing Foundation (CNCF), placing it under the foundation's vendor-neutral governance. The specification describes what an AI agent is allowed to reach, is licensed under Apache 2.0 and lives in the docker/sandbox-kit-spec repository. Docker unveiled the first Kits on 24 September 2026 in the opening keynote at WeAreDevelopers. It built them for their tools together with AWS, Box, Datadog, JFrog, Palo Alto Networks and Snyk, among others.

A Kit is an ordinary OCI image, not a new artifact type. It contains the agent, its tools and a typed list of everything the agent asks to reach, such as hosts, credentials and volumes. Because the list is part of the image, pinning the image pins the agent and its access requests together. Enforcing the list is the job of a conforming runtime, and Docker Sandboxes is the first.

Why it matters: Today every team writes its own rules for which network destinations, tokens and volume mounts an agent gets. With Kits, those rules move into the image and are versioned, signed and scanned along with the agent. For anyone running automation built on AI agents, that means permissions can be reviewed like any other dependency. What remains open is which runtimes besides Docker Sandboxes will enforce the list. Docker says that under CNCF governance Docker Sandboxes will not remain the only one, but names no other.